ASPackv102bAlexeySolodovnikov

Hunt Hypothesis

This rule identifies executable files packed with the ASPack v1.02b compressor, a technique frequently used by threat actors to obscure binary characteristics and evade static analysis. Proactively hunting for these packed binaries in Azure Sentinel allows the SOC team to detect potentially malicious or obfuscated payloads that may be executing on endpoints or stored in cloud storage before they trigger more advanced detection logic.

YARA Rule

rule ASPackv102bAlexeySolodovnikov
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D 81 ED 96 78 43 00 B8 90 78 43 00 03 C5 }
	$a1 = { 60 E8 [4] 5D 81 ED 96 78 43 ?? B8 90 78 43 ?? 03 C5 2B 85 7D 7C 43 ?? 89 85 89 7C 43 ?? 80 BD 74 7C 43 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legacy Application Deployment via Group Policy: In environments where older, unmanaged line-of-business applications are distributed via Group Policy Software Installation (GPO), the installer executable (often a self-extracting archive or a packed binary to reduce size) may match the ASPack signature. This is common in manufacturing or retail sectors using legacy POS or ERP systems.

  • Filter/Exclusion: Exclude files located in the C:\Windows\Installer or specific application directories (e.g., C:\Program Files\LegacyPOS\) if the file hash or name matches known legacy installers. Alternatively, exclude processes initiated by gpupdate.exe or msiexec.exe when the parent process is svchost.exe (Group Policy Client service).

• Third-Party Antivirus/Endpoint Protection Self-Updates: Many endpoint security solutions (e.g., older versions of Symantec, McAfee, or Kaspersky) use packed binaries for their update agents or service executables to protect their internal logic. The ASPack packer is historically used in some of these vendor-specific components, especially in long-term support (LTS) versions.

  • Filter/Exclusion: Exclude files signed by trusted certificate authorities (e.g., “Symantec Corporation”, “McAfee, Inc.”) or specific known vendor paths (e.g., C:\Program Files\McAfee\Agent\). Verify the digital signature validity before excluding.

• Scheduled Maintenance Jobs with Packed Utilities: IT operations teams often deploy custom maintenance scripts or small utility tools (e.g., disk cleanup, log rotation, or backup verification scripts) that are compiled and packed to reduce footprint. These are frequently executed via Windows Task Scheduler (schtasks.exe) or Task Scheduler service (svchost.exe - Task Scheduler service).

  • Filter/Exclusion: Exclude