ASPackv2001AlexeySolodovnikov

Hunt Hypothesis

This hunt hypothesis targets the execution of files matching the ASPack v2001 signature by Alexey Solodovnikov to identify potential obfuscated malware or legitimate packer usage that may evade standard AV signatures. Proactive hunting for this specific YARA rule in Azure Sentinel is essential to distinguish between benign application behavior and early-stage adversary activity that leverages known packing techniques to conceal malicious payloads.

YARA Rule

rule ASPackv2001AlexeySolodovnikov
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 72 05 00 00 EB 4C }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the ASPackv2001AlexeySolodovnikov detection rule, tailored for an enterprise environment:

• Scenario: Deployment of legacy third-party applications via SCCM or Intune.

  • Context: Many older line-of-business (LOB) applications and vendor tools (e.g., Adobe Acrobat Reader 2015+, legacy SAP GUI clients, or specialized medical imaging software) are often packed using ASPack v2001 to reduce installation size and protect intellectual property. When these executables are staged on the network or installed on endpoints, they trigger the rule.
  • Filter/Exclusion: Create a whitelist based on the specific SHA-256 hash of the known good installer executable (e.g., setup.exe located in C:\Program Files\VendorApp\). Alternatively, exclude the entire installation directory path (C:\Program Files\VendorApp\) from scanning if the vendor confirms the use of ASPack v2001.

• Scenario: Execution of scheduled backup and maintenance jobs on file servers.

  • Context: Enterprise backup solutions (such as Veeam Backup & Replication or Commvault) often utilize custom agents or helper utilities that are packed with ASPack to ensure integrity during automated nightly runs. When the vssvc.exe or specific agent processes launch at 02:00 AM, they may be flagged as suspicious packing activity.
  • Filter/Exclusion: Implement a time-based filter combined with process lineage. Exclude alerts where the parent process is VeeamAgentService.exe (or similar backup daemon) and the execution occurs within the defined maintenance window (e.g., 01:00–05:00).

• Scenario: Administrative distribution of internal utilities via Group Policy or GPO. *