ASPackv100bAlexeySolodovnikov

Hunt Hypothesis

This detection identifies the execution of files packed with ASPack v100, a technique often employed by adversaries to obscure malicious payloads and evade signature-based analysis within Azure Sentinel environments. Proactively hunting for this behavior is essential because low-severity alerts may indicate early-stage reconnaissance or fileless attacks that require deeper behavioral investigation before they escalate into significant incidents.

YARA Rule

rule ASPackv100bAlexeySolodovnikov
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 [4] 5D 81 ED 92 1A 44 ?? B8 8C 1A 44 ?? 03 C5 2B 85 CD 1D 44 ?? 89 85 D9 1D 44 ?? 80 BD C4 1D 44 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the ASPackv100bAlexeySolodovnikov YARA rule, which typically detects ASPack-packed executables often associated with malware:

• Scenario: Automated Patch Deployment via SCCM/Intune

  • Context: The enterprise uses Microsoft System Center Configuration Manager (SCCM) or Intune to deploy monthly security patches. These distribution points frequently package installer executables using the ASPack compression tool to reduce bandwidth usage during deployment.
  • Filter/Exclusion: Exclude files located in the C:\Windows\CCM\Logs directory and any executable running under the ccmsetup.exe or Microsoft.IntuneManagementExtension process tree. Additionally, filter out files with a digital signature from “Microsoft Corporation” regardless of the packer type.

• Scenario: Third-Party Antivirus Engine Updates

  • Context: The organization utilizes Symantec Endpoint Protection (SEP) or McAfee Total Protection. Their background update service (Symantec AntiVirus or mfevcs.exe) downloads and unpacks definition updates that are often wrapped in ASPack containers before being written to the disk.
  • Filter/Exclusion: Create an exclusion for the specific vendor’s installation directories (e.g., C:\Program Files\Symantec Endpoint Protection or C:\ProgramData\McAfee). Furthermore, exclude any file where the “Publisher” metadata in the digital signature matches the specific AV vendor name.

• Scenario: Scheduled Database Backup Jobs

  • Context: A nightly scheduled task runs a custom backup utility (e.g., Veeam Agent or a proprietary SQL backup tool) that compresses and archives database logs. The compression engine utilized by this tool employs ASPack v100b to optimize the archive size before transmission to the storage