PseudoSigner01LTC13Anorganix

Hunt Hypothesis

This rule identifies the presence of the PseudoSigner01LTC13Anorganix YARA signature, which targets specific malware strains or trojans that may be used for initial access or persistence. Proactively hunting for this indicator allows the SOC to detect low-severity threats that might evade standard behavioral detections, ensuring early identification of compromised assets before they progress to lateral movement or data exfiltration.

YARA Rule

rule PseudoSigner01LTC13Anorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 54 E8 00 00 00 00 5D 8B C5 81 ED F6 73 40 00 2B 85 87 75 40 00 83 E8 06 E9 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A developer or DevOps engineer uses a custom build script or CI/CD pipeline (e.g., Jenkins, GitHub Actions) that injects a specific metadata string or version tag into the binary header during the compilation or packaging phase. This often happens when using tools like objcopy (on Linux) or editbin (on Windows) to set the “OriginalFilename” or “FileDescription” fields to a unique build identifier that matches the YARA string.

  • Filter/Exclusion: Exclude files located in build artifact directories (e.g., C:\builds\, /var/www/html/builds/) or exclude processes spawned by known build agents (e.g., jenkins.exe, agent.exe). Additionally, consider excluding files where the PE header indicates a recent build timestamp (less than 24 hours old) if the rule targets static binaries.

• Scenario: An IT administrator uses a third-party utility like Advanced Renamer or BulkFileChanger to rename or modify metadata for a large batch of application installers or update packages. Some of these tools may inadvertently overwrite or append specific strings to the file’s metadata or resource section, triggering the YARA match if the tool uses a default naming convention that overlaps with the rule’s pattern.

  • Filter/Exclusion: Exclude files modified by known administrative utilities (e.g., AdvancedRenamer.exe, BulkFileChanger.exe). You can also filter based on the parent process name if the detection is process-based, or exclude files in temporary staging areas (e.g., C:\Users\Public\Downloads\, C:\Temp\) where bulk operations are commonly staged.

• Scenario: A legacy application or custom internal tool uses a specific logging library or framework (e.g., a modified version of Log4j or a custom C++ logging wrapper)