SuckStop v111 Hint DOS EP

Hunt Hypothesis

This YARA rule targets the entry point of the SuckStop v111 Hint DOS EP malware, a low-severity threat often associated with initial access or lateral movement via executable files. Proactively hunting for this signature in Azure Sentinel allows the SOC team to identify potentially compromised endpoints or stored artifacts before the malware can establish persistence or execute further malicious actions.

YARA Rule

rule SuckStop_v111_Hint_DOS_EP: PEiD
{
    strings:
        $a = { EB ?? ?? ?? BE ?? ?? B4 30 CD 21 EB ?? 9B }
    condition:
        $a at pe.entry_point

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legacy DOS-Based Utility Execution via DOSBox or JEMM

  • Scenario: An operations engineer runs a legacy inventory management tool (e.g., INV95.EXE) inside a DOSBox container or JEMM (Java Emulator for MS-DOS) to migrate data from a decommissioned mainframe. The YARA rule matches the DOS EP (Entry Point) signature in the memory or file because the executable retains its original DOS header structure, even when wrapped or emulated.
  • Filter/Exclusion: Exclude processes where the parent process is dosbox.exe, dosbox-x.exe, or jemm.exe. Additionally, exclude file paths containing \dosbox\ or \legacy_apps\ if these directories are designated for legacy software.

• Scheduled Job for Legacy Batch Processing

  • Scenario: A nightly scheduled task (LegacyReportGen) executes a small DOS-based utility (REPORT.DOS) that generates fixed-width text reports for downstream mainframe feeds. The rule triggers because the file has a DOS EP and matches the “Hint” heuristic, which often flags small, static DOS executables.
  • Filter/Exclusion: Exclude execution if the parent process is schtasks.exe or taskeng.exe and the command line contains the specific legacy script name (e.g., LegacyReportGen). Alternatively, whitelist the specific file hash or path \C:\Scripts\Legacy\REPORT.DOS if the utility is version-controlled and known.

• Development Environment: Testing DOS Compatibility Layer

  • Scenario: A developer on the platform team is testing a new compatibility layer for Windows 11 by running a suite of DOS-era games or utilities (e.g., DOOM.EXE, QUAK.EXE) in a dedicated test VM or container. The YARA rule detects the DOS EP in