FSGv100Engdulekxt

Hunt Hypothesis

This YARA rule targets specific file signatures associated with the FSGv100Engdulekxt malware family, indicating the presence of a low-severity threat actor deploying custom or obfuscated payloads within the environment. Proactively hunting for these artifacts in Azure Sentinel allows the SOC team to identify dormant or stealthy infections that may evade standard behavioral detections, thereby reducing the risk of lateral movement or data exfiltration before the adversary establishes a foothold.

YARA Rule

rule FSGv100Engdulekxt
{
      meta:
		author="malware-lu"
strings:
		$a0 = { BB D0 01 40 00 BF 00 10 40 00 BE [3] 00 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A developer or DevOps engineer uses a legitimate build automation tool (e.g., Jenkins, GitHub Actions, or Azure DevOps) that downloads a specific version of a compiler or utility (e.g., MinGW, Go, or Rust) to a temporary directory for a CI/CD pipeline. The binary or script matches the YARA signature due to common string patterns or structural similarities in the tool’s distribution.

  • Filter/Exclusion: Exclude processes where the parent process is a known CI/CD agent (e.g., jenkins.exe, agent.exe, vsts-agent.exe) or where the file path contains standard build directories like \build\, \tmp\, or \workspace\.

• Scenario: An IT administrator performs a scheduled maintenance task using a third-party patch management or backup solution (e.g., Veeam, Rubrik, or WSUS client updates) that temporarily stages a helper executable or script in the user’s %TEMP% or %APPDATA% folder. This staging file may match the YARA rule if it shares common header bytes or string literals with the malicious payload.

  • Filter/Exclusion: Exclude files located in standard backup or patch management directories (e.g., \Veeam\, \Rubrik\, \WindowsUpdate\) or processes initiated by known service accounts (e.g., svc_backup, admin_patch) during defined maintenance windows.

• Scenario: A user installs or updates a legitimate software package via a package manager (e.g., Chocolatey, Winget, or PowerShellGet) that extracts a native binary or installer component to a local cache folder. The extracted file may trigger the rule if it is a generic C/C++ compiled binary with common function names or import table entries that overlap with the YARA pattern.