XComp V098 LZMA JoKo

Hunt Hypothesis

This rule identifies the presence of the XComp V098 LZMA JoKo component, a specific variant of the XComp malware family often used for initial access or lateral movement in enterprise environments. Proactively hunting for this signature allows the SOC to detect dormant or low-noise infections that may evade standard behavioral detections, ensuring timely remediation before the malware establishes deeper persistence or exfiltrates data.

YARA Rule

rule XComp_V098_LZMA_JoKo: PEiD
{
    strings:
        $a = { 68 ?? ?? ?? 00 9C 60 E8 75 06 00 00 34 ?? ?? 00 00 00 00 00 00 00 00 00 4C ?? ?? 00 34 ?? ?? 00 00 00 00 }
    condition:
        $a at pe.entry_point

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A system administrator manually compresses a large log archive or backup set using 7-Zip or WinRAR with the LZMA algorithm before transferring it to a secondary storage server or external drive.
  • Filter/Exclusion: Exclude files located in standard backup directories (e.g., C:\Backups\, D:\Archives\) or files with extensions .7z, .rar, and .tar.lzma created within the last 24 hours by known admin service accounts.
• Scenario: An automated nightly scheduled task runs a custom PowerShell or Batch script that packages application configuration files or database dumps using python -m zipfile or a C# utility leveraging the LZMA compression library for incremental backups.
  • Filter/Exclusion: Exclude processes initiated by schtasks or Task Scheduler where the parent process is svchost.exe (specifically the Task Scheduler service) and the file path matches the designated application data folder (e.g., C:\ProgramData\AppName\Backups\).
• Scenario: A developer or DevOps engineer uses git with a custom filter or tar with lzma compression to package source code or build artifacts for a CI/CD pipeline artifact store, often triggered by a Jenkins or Azure DevOps agent.
  • Filter/Exclusion: Exclude files in the CI/CD workspace directories (e.g., C:\Jenkins\workspace\, C:\AzureDevOps\agent\_work\) or files created by processes named git.exe, tar.exe, or python.exe running under a service account associated with the build agents.
• Scenario: A Java or .NET application uses the java.util.zip or System.IO.Compression libraries (which may internally use LZMA or similar algorithms depending on the