Detecting and Blocking a Stealthy Adware: BJCAUpdate.exe Case Study

On April 2, 2025, I encountered an interesting adware case involving a digitally signed executable that initially appeared legitimate, but upon further investigation, revealed malicious behavior. This post outlines how I identified, analyzed, and proactively blocked the threat using YARA, custom IOA rules, and IOC management.

Earlier in the day, I observed two separate endpoint detections involving the same executable:

The file was digitally signed by a Chinese organization, [REDACTED], which raised concerns due to its reputation in public OSINT sources and community threat intel platforms. Despite the valid signature, the file’s behavior matched that of typical adware or potentially unwanted applications.

The stealthy execution, combined with network activity and its persistence mechanism, confirmed my suspicion: this was more than just a harmless updater.

I created a custom IOC entry with the known SHA256 hash:

This IOC was added with a “Prevent” policy across all Windows hosts to immediately block further execution.

To cover any repacked or renamed variants of the same behavior, I wrote a Custom IOA rule targeting:

This behavior-based approach ensured broader protection against future modifications of the executable.

I also crafted a YARA rule to detect the threat based on its file path, command-line behavior, certificate string, and hash — giving me layered defense.

I implemented a Falcon Workflow that automatically:

Shortly after deploying the IOC and IOA, two new detections were logged, both of which were blocked successfully. This confirmed that the controls were working as intended.

Stay vigilant, automate what you can, and never underestimate seemingly “signed” executables.