VxBackfont900

Hunt Hypothesis

This hypothesis targets the presence of the VxBackfont900 YARA signature, which indicates a specific malicious or suspicious code pattern often associated with backdoor implants or low-level system modifications. Proactively hunting for this indicator in Azure Sentinel allows the SOC to identify compromised workstations or servers early, potentially uncovering stealthy persistence mechanisms or data exfiltration channels before they escalate to higher-severity incidents.

YARA Rule

rule VxBackfont900
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 [2] B4 30 CD 21 3C 03 [2] B8 [2] BA [2] CD 21 81 FA [4] BA [2] 8C C0 48 8E C0 8E D8 80 [3] 5A [2] 03 [3] 40 8E D8 80 [3] 5A [2] 83 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: The VxBackfont900 YARA rule likely targets specific byte patterns or string signatures associated with a known backdoor variant (potentially related to “Backfont” or a specific CVE exploit kit component). A common false positive occurs when Microsoft Defender for Endpoint or CrowdStrike Falcon performs a full system scan and loads the YARA rule definition file itself into memory for processing, or when a developer’s Visual Studio instance compiles a C/C++ project containing the specific hex string or font-table structure that matches the rule’s byte or string condition.

  • Filter/Exclusion: Exclude processes named MsMpEng.exe (Defender) or csagent.exe (CrowdStrike) from YARA scanning if the rule is applied via a host-based scanner. Alternatively, exclude file paths under C:\Users\*\AppData\Local\Temp\ or C:\Program Files (x86)\Microsoft Visual Studio\ if the match is on a source code file or temporary build artifact.

• Scenario: An enterprise Adobe Creative Cloud suite update or a Font Manager tool (like FontBase or Font Manager) installs or updates a specific TrueType/OpenType font file that contains a malformed or non-standard glyf table structure, which inadvertently matches the byte-level signature of the VxBackfont900 rule. This often happens during automated SCCM (System Center Configuration Manager) deployment of design software packages.

  • Filter/Exclusion: Exclude files with extensions .ttf, .otf, or .dfont located in C:\Windows\Fonts\ or C:\Program Files\Adobe\ from the YARA scan. If the rule is memory-based, exclude processes like FontAgent.exe or AdobeCreativeCloud.exe during