ASPackv212AlexeySolodovnikov

Hunt Hypothesis

This detection identifies potential malicious activity associated with the ASPack v212 packer signature identified by Alexey Solodovnikov, which often indicates obfuscated executables used to conceal malware or suspicious payloads within the environment. Proactively hunting for this behavior in Azure Sentinel is essential because low-severity detections of known packing tools can serve as early indicators of sophisticated evasion techniques that might otherwise be overlooked until a broader incident occurs.

YARA Rule

rule ASPackv212AlexeySolodovnikov
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 }
	$a1 = { 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the ASPackv212AlexeySolodovnikov YARA rule, which typically detects ASPack-packed executables often associated with malware obfuscation:

• Scenario: Deployment of Patched Enterprise Applications via SCCM/Intune

  • Context: System administrators frequently use Microsoft Endpoint Configuration Manager (SCCM) or Intune to deploy updated versions of enterprise software (e.g., Adobe Acrobat, Zoom, or Java Runtimes). These installers are often repackaged using ASPack by the vendor to reduce file size and protect intellectual property.
  • Filter/Exclusion: Create a path-based exclusion for known installer directories.
    • EXCLUSION_PATH: C:\Program Files\Microsoft Configuration Manager\AdminConsole\
    • EXCLUSION_PATH: C:\Windows\CCM\
    • Add specific file hashes of the latest vendor-signed installers to a whitelist database if path exclusions are too broad.

• Scenario: Scheduled Backup Agent Execution

  • Context: Enterprise backup solutions like Veeam Agent for Microsoft Windows or Acronis Cyber Protect run scheduled jobs daily. The agent executables and their associated compression modules often utilize ASPack to bundle the backup engine, triggering the rule during routine maintenance windows (e.g., 02:00 AM).
  • Filter/Exclusion: Implement a process-name and time-based filter.
    • FILTER_CONDITION: ProcessName IN ('VeeamAgent.exe', 'AcronisBackupService.exe') AND TimeWindow BETWEEN 01:00 AND 05:00
    • Exclude files located in the vendor’s specific installation root (e.g., C:\Program Files\Veeam\...).

• Scenario: Execution of Internal DevOps Build Artifacts