ASPackv107bAlexeySolodovnikov

Hunt Hypothesis

This rule detects the presence of ASPack v1.07b, a legacy packer frequently used by threat actors to compress and obfuscate malicious executables to evade static analysis. Proactively hunting for this specific signature allows the SOC team to identify potentially compromised hosts or dormant payloads that may have been overlooked by standard AV detections due to their low severity classification.

YARA Rule

rule ASPackv107bAlexeySolodovnikov
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 [4] 5D 81 ED [4] B8 [4] 03 C5 2B 85 ?? 0B DE ?? 89 85 17 DE [2] 80 BD 01 DE }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legacy Application Deployment via Group Policy

  • Scenario: An IT administrator deploys a critical, legacy line-of-business application (e.g., an older version of a financial reporting tool or industrial control software) that was compiled using ASPack v1.07b to reduce file size. The executable is pushed to endpoints via Group Policy Software Installation or a Configuration Manager (SCCM) package, triggering the YARA rule on the client side during the file write or execution phase.
  • Filter/Exclusion: Exclude files located in standard application installation directories (e.g., C:\Program Files\, C:\Program Files (x86)\) that match the specific vendor name or known good hash (SHA-256) of the deployed legacy application. Alternatively, exclude processes initiated by gpupdate.exe or ccmexec.exe if the rule is process-based.

• Scheduled Backup or Maintenance Jobs

  • Scenario: A nightly scheduled task runs a custom maintenance script or utility (e.g., a disk defragmenter, log cleaner, or database optimizer) that is packed with ASPack v1.07b to optimize startup time. The task is triggered by the Windows Task Scheduler (schtasks.exe or svchost.exe running the task engine), and the packed executable is loaded into memory, matching the YARA signature.
  • Filter/Exclusion: Exclude executions where the parent process is schtasks.exe, svchost.exe (specifically the task scheduler service), or taskeng.exe. Additionally, whitelist the specific file path of the maintenance utility (e.g., C:\Scripts\Maintenance\clean_logs.exe) if it is a known internal tool.

• Third-Party Security or Monitoring Agents

  • Scenario: An enterprise endpoint detection and response (EDR) agent or