This rule identifies potentially compromised or malicious Visual C++ binaries by matching specific code patterns, indicating that an adversary may have deployed custom tooling or backdoors within the environment. Proactively hunting for these signatures allows the SOC team to detect low-severity threats that might evade traditional signature-based detections, ensuring early identification of suspicious executables before they can establish persistence or execute further malicious actions.
rule MicrosoftVisualCV80
{
meta:
author="malware-lu"
strings:
$a0 = { 6A 14 68 [4] E8 [4] BB 94 00 00 00 53 6A 00 8B [5] FF D7 50 FF [5] 8B F0 85 F6 75 0A 6A 12 E8 [4] 59 EB 18 89 1E 56 FF [5] 56 85 C0 75 14 50 FF D7 50 FF [5] B8 }
condition:
$a0 at pe.entry_point
}
This YARA rule can be deployed in the following contexts:
This rule contains 1 string patterns in its detection logic.
MSBuild.exe, devenv.exe, or csc.exe (C# Compiler) and the file path contains \bin\ or \obj\.msiexec.exe) executing custom actions or DLLs that were compiled with the Visual C++ 2005/2008 runtime (v8.0) during software installations or updates.
msiexec.exe and the command line contains /i (install) or /a (admin) flags.TaskScheduler (svchost.exe with TasksSched service) or specific known service executables (e.g., UpdateService.exe) where the DLL name matches msvcr80.dll or msvcp80.dll.VeeamBackup.exe, `commvault