ASPackv103bAlexeySolodovnikov

Hunt Hypothesis

This rule detects the presence of ASPack v103b, a specific version of a popular executable packer frequently used by threat actors to compress and protect malicious payloads while evading static analysis. Proactively hunting for this signature allows the SOC to identify potentially obfuscated binaries within the environment, reducing the risk of undetected malware execution or persistence mechanisms that leverage packing techniques to hide their true nature.

YARA Rule

rule ASPackv103bAlexeySolodovnikov
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 [4] 5D 81 ED AE 98 43 ?? B8 A8 98 43 ?? 03 C5 2B 85 18 9D 43 ?? 89 85 24 9D 43 ?? 80 BD 0E 9D 43 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: Execution of legacy or third-party application installers that bundle the ASPack 1.03b packer to reduce file size, such as older versions of Adobe Acrobat Reader or Java Runtime Environment (JRE) installers.

  • Filter/Exclusion: Exclude files located in standard installation directories (e.g., C:\Program Files\, C:\Program Files (x86)\) or specific known-good paths like C:\Program Files\Java\ and C:\Program Files\Adobe\. Additionally, exclude if the parent process is a known installer service like msiexec.exe or setup.exe.

• Scenario: Scheduled maintenance tasks or backup agents that use packed executables to optimize disk space or execution speed, such as Veeam Backup & Replication agents or Commvault client services.

  • Filter/Exclusion: Exclude processes running from vendor-specific backup directories (e.g., C:\Program Files\Veeam\, C:\Program Files\Commvault\). You can also whitelist specific service names (e.g., VeeamBackupSvc.exe, cvsvc.exe) if they are known to use this packer.

• Scenario: Development or QA environments where engineers run packed debug builds or unit test binaries using tools like Visual Studio or JetBrains Rider for performance testing.

  • Filter/Exclusion: Exclude files located in development workspace directories (e.g., C:\Users\<user>\Documents\Visual Studio\, C:\dev\, C:\builds\). Consider excluding if the parent process is a known IDE or build tool like devenv.exe (Visual Studio) or idea64.exe (IntelliJ/Rider).

• Scenario: Legacy line-of-business (LOB) applications or