ASPackv211dAlexeySolodovnikov

Hunt Hypothesis

This detection identifies the execution of files packed with the ASPack v2.11 compressor by Alexey Solodovnikov, a technique frequently employed by adversaries to obfuscate malicious payloads and evade static analysis. SOC teams should proactively hunt for this behavior in Azure Sentinel to uncover stealthy threats that may bypass traditional signature-based defenses due to their compressed structure.

YARA Rule

rule ASPackv211dAlexeySolodovnikov
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 02 00 00 00 EB 09 5D 55 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the ASPackv211dAlexeySolodovnikov YARA rule, along with recommended filters or exclusions:

• Scenario: Legitimate execution of Microsoft Office Click-to-Run updates.

  • Context: The ASPack v2.11d signature is frequently used by Microsoft’s update mechanisms to compress and protect the OfficeClickToRun.exe payload during scheduled maintenance windows. This often triggers on the file hash or embedded resource structure of the updater.
  • Filter/Exclusion: Exclude files located in C:\Program Files\Microsoft Office\root\Office16\ where the process name is OfficeC2RClient.exe or Setup.exe.

• Scenario: Deployment of Sysinternals PsExec for remote administration.

  • Context: Administrators frequently use PsExec.exe to run scripts on remote servers. The tool often utilizes ASPack compression for its internal modules and temporary payload files, causing the YARA rule to flag the executable as a potential packed malware carrier during routine patching tasks.
  • Filter/Exclusion: Create an exclusion based on the file path C:\ProgramData\Microsoft\Windows Defender\Tools\ or specifically exclude any process with the command line containing \PsExec.exe originating from the Sysinternals directory.

• Scenario: Scheduled backup jobs using Veeam Backup & Replication.

  • Context: Veeam’s data mover agents and console applications often include ASPack-compressed libraries to reduce disk footprint during nightly backups. The rule may detect these compressed DLLs or executables as suspicious when the backup service (Veeam.Backup.Service) initiates a job.
  • Filter/Exclusion: Exclude processes with the image path containing `C:\