ASPackv2xxAlexeySolodovnikov

Hunt Hypothesis

This hypothesis targets the presence of executables packed with the ASPack v2xx compression algorithm, a technique often employed by threat actors to reduce file size and evade static analysis during initial access or lateral movement. Proactively hunting for these signatures in Azure Sentinel allows the SOC to identify potentially obfuscated payloads on endpoints before they execute, reducing the risk of undetected malware deployment in cloud-connected environments.

YARA Rule

rule ASPackv2xxAlexeySolodovnikov
{
      meta:
		author="malware-lu"
strings:
		$a0 = { A8 03 00 00 61 75 08 B8 01 00 00 00 C2 0C 00 68 00 00 00 00 C3 8B 85 26 04 00 00 8D 8D 3B 04 00 00 51 50 FF 95 }
	$a1 = { A8 03 [2] 61 75 08 B8 01 [3] C2 0C ?? 68 [4] C3 8B 85 26 04 [2] 8D 8D 3B 04 [2] 51 50 FF 95 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legacy .NET Application Deployment via Group Policy

  • Scenario: An enterprise IT team deploys a custom, internally developed line-of-business (LOB) application written in C# or VB.NET. The developer used the ASPack packer (version 2.x) to reduce the binary size and protect intellectual property before compiling. When this executable is pushed to endpoints via Group Policy Software Installation or SCCM, the YARA rule triggers on the new binary.
  • Filter/Exclusion: Exclude files located in specific application directories (e.g., C:\Program Files\CorporateLOBApp\) or exclude binaries signed by the internal corporate code-signing certificate (Signer: "Corporate IT Security").

• Third-Party Support Tool Installation

  • Scenario: A support engineer installs a legacy vendor-provided diagnostic or monitoring agent (e.g., a specific version of a network scanner or log collector) that was compiled with ASPack to obfuscate its internals. The installer drops the packed executable into a standard vendor folder, triggering the detection during the installation process.
  • Filter/Exclusion: Exclude paths containing known vendor names (e.g., C:\Program Files\VendorName\Tools\) or exclude files where the Product or Company metadata matches a known trusted vendor (e.g., Company: "Acme Corp").

• Scheduled Maintenance Job Execution

  • Scenario: A scheduled task (e.g., DailyDBBackup) runs a small utility script or binary that has been packed with ASPack to avoid detection by other security tools or to reduce disk footprint. This utility is a known, whitelisted component of the backup solution and runs from a service account context.
  • Filter/Exclusion: Exclude the specific file path (e.g., `C:\Scripts\BackupUtils\cleaner.exe