TurboBAT v310 50 Patched Hint DOS EP

Hunt Hypothesis

This hypothesis targets the presence of TurboBAT v310.50, a patched variant of the TurboBAT backdoor that utilizes a DOS executable entry point, indicating potential compromise by threat actors leveraging this specific malware family for initial access or persistence. Proactively hunting for this signature in Azure Sentinel allows the SOC team to identify dormant or active infections that may have evaded standard behavioral detections, ensuring timely containment of known low-severity threats before they escalate.

YARA Rule

rule TurboBAT_v310_50_Patched_Hint_DOS_EP: PEiD
{
    strings:
        $a = { 90 90 90 90 90 90 90 06 B8 ?? ?? 8E C0 B9 ?? ?? 26 ?? ?? ?? ?? 80 ?? ?? 26 ?? ?? ?? 24 ?? 3A C4 90 90 }
    condition:
        $a at pe.entry_point

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A legacy line-of-business application (e.g., a specific version of SAP GUI or Oracle Client) that has been patched but retains a specific DOS header structure and entry point alignment, triggering the “Patched Hint DOS EP” condition during routine application startup or update cycles.

  • Filter/Exclusion: Exclude executable files located in known application directories (e.g., C:\Program Files\SAP\FrontEnd\) or specific known-good hashes (SHA256) associated with the patched version of the software.

• Scenario: A developer or IT admin uses a generic PE packer (such as UPX or FSG - Fast Static Guard) to compress a small utility script or custom internal tool for distribution, which inadvertently modifies the DOS header and entry point in a way that matches the TurboBAT v310 signature.

  • Filter/Exclusion: Exclude files with a .exe extension that are located in developer workspaces (e.g., C:\Users\<dev_user>\Projects\) or have a file size below a certain threshold (e.g., < 50KB) if the rule is primarily targeting larger binaries, or add an exclusion for known packer signatures if the YARA rule allows for nested conditions.

• Scenario: A scheduled maintenance job runs a custom batch wrapper or a small C++ compiled helper script (e.g., cleanup_helper.exe) that is compiled with an older version of MinGW or MSVC where the default linker settings produce a DOS header and EP alignment matching the rule, especially if the tool is not digitally signed.

  • Filter/Exclusion: Exclude executables that are digitally signed by the internal corporate CA (Certificate Authority) or are located in the C:\Windows\System32\ or `C:\ProgramData\Internal