ASPackv21AlexeySolodovnikov

Hunt Hypothesis

This hypothesis targets the presence of ASPack v2.1 packers, a tool frequently used by threat actors to compress and obfuscate malicious payloads to evade static analysis. Proactively hunting for this signature in Azure Sentinel allows the SOC to identify potentially compromised endpoints or staging areas where adversaries are preparing executables for deployment or lateral movement.

YARA Rule

rule ASPackv21AlexeySolodovnikov
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 72 05 00 00 EB 33 87 DB 90 00 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legacy Application Deployment via Group Policy: When IT deploys older, un-recompiled business applications (e.g., legacy ERP clients or specialized industrial control software) that were packed with ASPack v2.1 to reduce file size, the executable may trigger the YARA rule during initial deployment or subsequent updates.
  • Filter/Exclusion: Exclude files located in specific application directories (e.g., C:\Program Files\LegacyERP\bin\) or add an exclusion for known legacy application names (e.g., LegacyClient.exe) if the packing is intentional and verified by the vendor.
• Third-Party Installer Bootstrappers: Many commercial software installers (e.g., Adobe Creative Suite, Oracle Java, or specific database drivers) use packed bootstrapper executables to download and extract components. If the installer binary itself is packed with ASPack, it will match the rule during standard software installation tasks.
  • Filter/Exclusion: Exclude processes with parent processes like msiexec.exe or setup.exe that are running from standard installation paths (e.g., C:\Windows\Installer\ or C:\Temp\), or whitelist specific installer names (e.g., AdobeSetup.exe, jre-8u-*.exe) known to use this packing technique.
• Scheduled Maintenance Jobs for Packed Utilities: Administrative tasks that run small, packed utility scripts or tools (e.g., a custom log rotation script or a disk cleanup tool) via Task Scheduler may trigger the rule if the utility executable was packed to optimize size. These are often run under the SYSTEM or Administrators account.
  • Filter/Exclusion: Exclude executions where the parent process is svchost.exe (for scheduled tasks) or taskschd.msi, and the file path resides in administrative tool directories (e.g., `