FSGv120EngdulekxtMicrosoftVisualC60

Hunt Hypothesis

This rule detects the presence of a specific Visual C++ 6.0 binary artifact, often associated with legacy or potentially compromised applications that may be used for persistence or initial access. Proactively hunting for this signature helps identify outdated software components that adversaries might leverage to blend in with normal system processes or establish a foothold within the environment.

YARA Rule

rule FSGv120EngdulekxtMicrosoftVisualC60
{
      meta:
		author="malware-lu"
strings:
		$a0 = { C1 E0 06 EB 02 CD 20 EB 01 27 EB 01 24 BE 80 ?? 42 00 49 EB 01 99 8D 1D F4 00 00 00 EB 01 5C F7 D8 1B CA EB 01 31 8A 16 80 E9 41 EB 01 C2 C1 E0 0A EB 01 A1 81 EA A8 8C 18 A1 34 46 E8 01 00 00 00 62 59 32 D3 C1 C9 02 EB 01 68 80 F2 1A 0F BE C9 F7 D1 2A D3 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legacy Application Deployment via Group Policy: When IT admins deploy older internal line-of-business applications compiled with Visual C++ 6.0 (e.g., custom inventory management tools or legacy financial reporting modules) to endpoints via Group Policy Software Installation, the executable files often reside in the C:\Program Files\ directory and match the YARA signature for VC6.0 binaries.

  • Filter/Exclusion: Exclude files located in standard application directories (C:\Program Files\, C:\Program Files (x86)\) that are owned by the Administrators group and have a creation timestamp older than 30 days, or specifically whitelist known legacy application paths (e.g., C:\Program Files\LegacyERP\bin\).

• Scheduled Backup or Maintenance Scripts: Enterprise scheduled tasks (e.g., Task Scheduler jobs running nightly) may execute small utility scripts or helper executables written in C++ using the VC6.0 runtime for compatibility with older backup agents (like legacy versions of Commvault or Veritas). These small, static executables often reside in C:\Windows\System32\ or C:\ProgramData\ and trigger the detection.

  • Filter/Exclusion: Exclude executables under 500KB in size that are located in C:\ProgramData\ or C:\Windows\System32\ and are associated with known backup or maintenance service accounts (e.g., svc_backup, svc_maint).

• Developer Testing Environments: In development or QA environments, engineers may run unit tests or integration test harnesses compiled with VC6.0 to ensure backward compatibility or to debug legacy code segments. These test executables are typically stored in project directories (e.g., C:\Users\<dev_user>\Projects\LegacyModule\test\) and are executed manually or via CI/CD pipelines on