ASPackv10801AlexeySolodovnikov

Hunt Hypothesis

This hypothesis targets the presence of executables packed with ASPack version 1.08.01, a known packer frequently utilized by threat actors to compress binaries and obscure their code from static analysis tools. Proactively hunting for this specific signature in Azure Sentinel allows the SOC to identify potentially malicious or obfuscated payloads that may have been introduced via phishing or supply chain attacks, ensuring that low-severity but high-impact stealth techniques are not overlooked during routine monitoring.

YARA Rule

rule ASPackv10801AlexeySolodovnikov
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 EB 0A 5D EB 02 FF 25 45 FF E5 E8 E9 E8 F1 FF FF FF E9 81 [3] 44 00 BB 10 ?? 44 00 03 DD 2B 9D }
	$a1 = { 60 EB 0A 5D EB 02 FF 25 45 FF E5 E8 E9 E8 F1 FF FF FF E9 81 [3] 44 ?? BB 10 ?? 44 ?? 03 DD 2B 9D }
	$a2 = { 60 EB ?? 5D EB ?? FF [5] E9 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point or $a2 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legacy Application Deployment via Group Policy:

  • Scenario: An IT administrator deploys a legacy line-of-business application (e.g., an old inventory management system or a specific CAD plugin) that was compiled using ASPack v1.0.8.01 to reduce file size. The executable is pushed to endpoints via Group Policy Object (GPO) or SCCM, triggering the YARA rule on the protected file system.
  • Filter/Exclusion: Exclude files located in specific application directories (e.g., C:\Program Files\LegacyApp\bin\) or filter by the specific hash of the known good executable if the version is static.

• Third-Party Vendor Tool Installation:

  • Scenario: A vendor provides a utility tool (such as a network scanner, log parser, or database backup agent) that has been packed with ASPack to protect intellectual property or reduce distribution size. The tool is installed by a service account or admin during a scheduled maintenance window.
  • Filter/Exclusion: Create a whitelist for the specific vendor’s installation directory (e.g., C:\Program Files\VendorName\Tools\) or exclude the process name if the tool runs under a known service account (e.g., svc_vendor_install).

• Scheduled Backup or Cleanup Job:

  • Scenario: A scheduled task (e.g., BackupCleanup.exe or LogArchiver.exe) runs nightly to compress or archive logs. If the executable for this script or binary was packed with ASPack to meet size constraints in a constrained environment, it triggers the detection during its regular execution cycle.
  • Filter/Exclusion: Exclude the specific scheduled task name (e.g., \Microsoft\Windows\BackupCleanup) or the parent process if it is launched by Task Scheduler (svchost.exe or `Taskeng.exe