Caracachs

Hunt Hypothesis

This detection rule identifies the presence of the Caracachs malware family by leveraging a specific YARA signature to flag known malicious code patterns within Azure Sentinel. Proactively hunting for this behavior is essential because, despite its current low severity rating, early identification allows the SOC team to validate potential lateral movement vectors and prevent the escalation of dormant threats before they impact critical workloads.

YARA Rule

rule Caracachs: sharedcode
{
	meta:
		copyright = "2015 Novetta Solutions"
		author = "Novetta Threat Research & Interdiction Group - [email protected]"
		Source = "eff542ac8e37db48821cb4e5a7d95c044fff27557763de3a891b40ebeb52cc55.ex_"

	strings:
	/*
		B9 10 00 00 00     mov     ecx, 10h        ; ecx = 16
		8B 06              mov     eax, [esi]      ; eax = lastValue
		C1 EA 10           shr     edx, 10h        ; edx = val >> 16
		81 E2 FF 7F 00 00  and     edx, 7FFFh      ; edx = (val >> 16) & 0x7FFF
		03 C2              add     eax, edx        ; eax = ((val >> 16) & 0x7FFF) + lastValue
		8B D0              mov     edx, eax        ; edx = ((val >> 16) & 0x7FFF) + lastValue
		8B F8              mov     edi, eax        ; edi = ((val >> 16) & 0x7FFF) + lastValue
		83 E2 0F           and     edx, 0Fh        ; edx = (((val >> 16) & 0x7FFF) + lastValue) & 0xF
		2B CA              sub     ecx, edx        ; ecx = 16 - ((((val >> 16) & 0x7FFF) + lastValue)) & 0xF
		D3 EF              shr     edi, cl         ; edi = (((val >> 16) & 0x7FFF) + lastValue) >> ((16 - ((val >> 16) & 0x7FFF) + lastValue) & 0xF)
		8B CA              mov     ecx, edx        ; ecx = (((val >> 16) & 0x7FFF) + lastValue) & 0xF
		D3 E0              shl     eax, cl         ; eax = (((val >> 16) & 0x7FFF) + lastValue) << ((((val >> 16) & 0x7FFF) + lastValue) & 0xF)
		0B F8              or      edi, eax        ; edi = (((val >> 16) & 0x7FFF) + lastValue) >> ((16 - ((val >> 16) & 0x7FFF) + lastValue) & 0xF) | (((val >> 16) & 0x7FFF) + lastValue) << ((((val >> 16) & 0x7FFF) + lastValue) & 0xF)
		89 3E              mov     [esi], edi      ; pLastValue = (((val >> 16) & 0x7FFF) + lastValue) >> ((16 - ((val >> 16) & 0x7FFF) + lastValue) & 0xF) | (((val >> 16) & 0x7FFF) + lastValue) << ((((val >> 16) & 0x7FFF) + lastValue) & 0xF)
	*/

	$a = {B? 10 00 00 00 8B ?? C1 ?? 10 81 ?? FF 7F 00 00 03 ?? 8B ?? 8B ?? 83 ?? 0F 2B ?? D3 ?? 8B ?? D3 ?? 0B ?? 	89 ?? 	}

	condition:
		$a in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Caracachs detection rule in an enterprise environment, including suggested filters and exclusions:

• Antivirus Real-Time Scanning of Large Archives

  • Scenario: The Caracachs malware is known to drop payloads into temporary directories. Enterprise Antivirus solutions (e.g., CrowdStrike Falcon, SentinelOne, or Microsoft Defender) often trigger the same YARA signatures when scanning large .zip or .7z archives containing legitimate software installers in the %TEMP% folder, mistaking the archive structure for a malicious drop.
  • Filter/Exclusion: Exclude processes matching C:\Program Files\*\*AntivirusEngine*.exe (e.g., MsMpEng.exe, SentinelOneAgent.exe) from triggering alerts when accessing paths under C:\Users\*\AppData\Local\Temp.

• Scheduled Software Deployment via SCCM/Intune

  • Scenario: During scheduled maintenance windows, the Microsoft Endpoint Configuration Manager (SCCM) or Microsoft Intune deployment agents execute PowerShell scripts to distribute updates. These scripts often extract executable payloads into C:\Windows\SoftwareDistribution or C:\ProgramData\Microsoft, creating file structures and memory signatures that mimic the Caracachs installation phase.
  • Filter/Exclusion: Add a whitelist for the specific parent process names: ccmexec.exe (SCCM) and IntuneManagementExtension.exe. Additionally, exclude alerts where the execution path contains \Microsoft\CCM\ or \Microsoft Intune Management Extension\.

• Enterprise Backup Agent Operations

  • Scenario: Enterprise backup solutions like Veeam Backup & Replication, Commvault, or Acronis Cyber Protect periodically scan and compress active database files (e.g., SQL