UG2002Cruncherv03b3

Hunt Hypothesis

This rule detects the presence of the Cruncher malware family, which is commonly used by adversaries to establish persistence and execute malicious payloads on compromised hosts. Proactively hunting for this signature in Azure Sentinel allows the SOC team to identify low-severity infections early, preventing potential lateral movement or escalation within the environment.

YARA Rule

rule UG2002Cruncherv03b3
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 [4] 5D 81 ED [4] E8 0D [16] 58 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A developer or build engineer runs the Cruncher (a popular open-source tool for compressing and optimizing game assets, often used in Unity or Unreal Engine pipelines) on a local workstation or CI/CD agent to process large texture bundles. The binary’s specific versioning or string patterns match the YARA signature UG2002Cruncherv03b3, triggering an alert despite being a known, signed, or whitelisted application.

  • Filter/Exclusion: Exclude processes where the executable path matches C:\Tools\Cruncher\cruncher.exe or C:\BuildAgents\workspace\cruncher\bin\cruncher.exe, and verify the file hash against a known-good baseline for the specific version used in the build pipeline.

• Scenario: An IT administrator uses Cruncher as a lightweight utility to compress log files or backup archives before transferring them to an off-site storage location via Robocopy or rsync. The tool is invoked from a scheduled task (cruncher_logs.bat) that runs nightly, and the YARA rule matches the binary’s unique section headers or string constants, flagging it as suspicious.

  • Filter/Exclusion: Create an exclusion for processes named cruncher.exe (or cruncher64.exe) that are spawned by cmd.exe or powershell.exe from the C:\Admin\Scripts\ directory, and ensure the parent process has a valid digital signature from the internal IT department.

• Scenario: A data scientist or ML engineer uses Cruncher (or a similar compression utility with a similar name/signature) to pre-process large CSV or Parquet files for training datasets. The tool is run via Jupyter Notebook or Python scripts, and the YARA rule triggers because the binary