ASPackv108xAlexeySolodovnikov

Hunt Hypothesis

This rule identifies the presence of ASPack v1.08, a legacy executable packer frequently used by threat actors to compress and obfuscate malicious payloads to evade static analysis. Proactively hunting for this specific version in Azure Sentinel allows the SOC to uncover dormant or low-and-slow threats that may have been overlooked by standard AV signatures due to their packed nature.

YARA Rule

rule ASPackv108xAlexeySolodovnikov
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 EB 03 5D FF E5 E8 F8 FF FF FF 81 ED 1B 6A 44 00 BB 10 6A 44 00 03 DD 2B 9D 2A }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legacy Application Deployment via SCCM/Intune: Organizations often deploy older, unmanaged line-of-business applications (e.g., legacy POS systems, specialized engineering CAD tools) that were compiled with older versions of ASPack to reduce file size. These executables may be pushed to endpoints via Microsoft Endpoint Configuration Manager (SCCM) or Intune.

  • Filter/Exclusion: Exclude files located in standard application directories (e.g., C:\Program Files\, C:\Program Files (x86)\) where the parent process is a known deployment agent (e.g., CCMEXEC.EXE, CCMEXEC32.EXE, IntuneAgent.exe) or where the file hash matches a known-good baseline for that specific application version.

• Third-Party Utility or Driver Installation: Many hardware vendors and utility software providers (e.g., GPU drivers, printer utilities, or backup agents like Veeam or Acronis) use ASPack to compress their installer executables or helper binaries. These are typically run by administrators during patching cycles or new hardware onboarding.

  • Filter/Exclusion: Exclude execution if the parent process is a known installer service (e.g., msiexec.exe, setup.exe, install.exe) or if the file path resides in a vendor-specific directory (e.g., C:\Program Files\NVIDIA Corporation\, C:\Program Files\HP\) and the user context is an administrative group (e.g., Domain Admins, IT_Support).

• Scheduled Maintenance Jobs for Legacy Tools: Some legacy backup scripts, log rotation utilities, or data migration tools (e.g., older versions of Robocopy wrappers, custom PowerShell scripts calling packed executables) are scheduled via Task Scheduler to run during off-hours. These packed executables may be stored in C:\Windows\System32\