ASPackv105bAlexeySolodovnikov

Hunt Hypothesis

This detection identifies the execution of ASPack v105b packer binaries, which adversaries frequently employ to obfuscate malicious payloads and evade static analysis by compressing or encrypting executable code. A proactive hunt is essential in Azure Sentinel because these packed executables often conceal hidden behaviors that standard signature-based defenses might miss until after an initial compromise occurs.

YARA Rule

rule ASPackv105bAlexeySolodovnikov
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 [4] 5D 81 ED CE 3A 44 ?? B8 C8 3A 44 ?? 03 C5 2B 85 B5 3E 44 ?? 89 85 C1 3E 44 ?? 80 BD AC 3E 44 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the ASPackv105bAlexeySolodovnikov detection rule, focusing on legitimate enterprise activities that utilize ASPack compression:

• Scenario: Deployment of Microsoft Office Click-to-Run Updates

  • Context: The Microsoft Office Click-to-Run (C2R) installer and update mechanism frequently utilizes ASPack to compress the OfficeClickToRun.exe payload during scheduled maintenance windows. This is a standard administrative task that triggers the rule when the update service downloads and executes the compressed binary.
  • Suggested Filter/Exclusion: Create an exclusion based on the file path C:\Program Files\Microsoft Office\root\Office16\ (or specific version folders) combined with the process name OfficeClickToRun.exe. Additionally, exclude files where the digital signature is verified by “Microsoft Corporation”.

• Scenario: Execution of Sysinternals Process Explorer or Process Monitor

  • Context: Security analysts and system administrators often use Sysinternals Suite tools (specifically ProcExp.exe and ProcMon.exe) to investigate system behavior. These tools are distributed as ASPack-packed executables. When an analyst launches these tools manually or via a scheduled script, the rule may flag them as potential packed malware.
  • Suggested Filter/Exclusion: Exclude any process where the publisher is “Mark Russinovich” (Sysinternals) and the file path resides within C:\Program Files\Sysinternals\. A YARA condition can be added to check for the specific digital signature subject name.

• Scenario: Scheduled Antivirus Definition Updates (e.g., Symantec or McAfee)

  • Context: Enterprise endpoint protection suites like Symantec Endpoint Protection or McAfee Total Protection often use ASPack-compressed updater agents (SrtUpd.exe