ASPackv211bAlexeySolodovnikov

Hunt Hypothesis

This detection identifies the execution of a specific ASPack v2.11b packer variant associated with Alexey Solodovnikov, which is frequently utilized by adversaries to obfuscate malicious payloads and evade static analysis. Proactively hunting for this signature in Azure Sentinel allows the SOC team to uncover stealthy threats that may bypass traditional antivirus solutions due to their packed nature, ensuring early visibility into potential supply chain or file-based attacks.

YARA Rule

rule ASPackv211bAlexeySolodovnikov
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 02 00 00 00 EB 09 5D 55 81 ED 39 39 44 00 C3 E9 3D 04 00 00 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the ASPackv211bAlexeySolodovnikov detection rule, which targets ASPack-packed executables often used by malware to obscure code:

• Scenario: Deployment of Patched Enterprise Applications via SCCM/Intune

  • Context: System administrators frequently deploy updated versions of legacy enterprise software (e.g., SAP GUI, Oracle Client, or specialized CAD tools) using Microsoft Endpoint Configuration Manager (SCCM) or Intune. These installers often utilize ASPack to compress the payload and reduce network transfer size during mass deployment.
  • Filter/Exclusion: Exclude files located in standard application installation paths (e.g., C:\Program Files\, C:\ProgramData\) where the file hash matches a known good baseline from the last 30 days, or specifically exclude executable names matching *Setup.exe and *Installer.exe if they are signed by trusted enterprise publishers.

• Scenario: Scheduled Antivirus Definition Updates

  • Context: Major antivirus vendors (such as Symantec Endpoint Protection, McAfee, or Kaspersky) often package their daily definition update engines using ASPack to minimize the download footprint and speed up the installation process on endpoints during off-hours.
  • Filter/Exclusion: Create an exclusion for processes running under the context of specific AV service accounts (e.g., SYSTEM or a dedicated AVServiceAccount) executing within the vendor’s installation directory (e.g., C:\Program Files\Symantec Endpoint Protection\*).

• Scenario: Execution of Custom PowerShell Scripts with Embedded Binaries

  • Context: DevOps teams often run scheduled maintenance jobs using PowerShell that invoke embedded, packed helper tools for tasks like log rotation or database backups. These helper binaries are frequently compressed with ASPack to ensure they remain lightweight within