ASProtect v123 RC4 build 0807 exe Alexey Solodovnikov h

Hunt Hypothesis

This rule identifies the presence of executables packed with ASProtect v123 RC4 build 0807, a protection scheme frequently utilized by threat actors to obscure malicious payloads and evade static analysis. Proactively hunting for this specific packer signature allows the SOC to uncover hidden or dormant malware artifacts that may have been introduced through supply chain compromises or initial access vectors, ensuring early detection before dynamic execution occurs.

YARA Rule

rule ASProtect_v123_RC4_build_0807_exe_Alexey_Solodovnikov_h: PEiD
{
    strings:
        $a = { 90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB ?? ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 D5 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
        $b = { 90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB ?? ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 D5 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 B8 F8 C0 A5 23 50 50 03 45 4E 5B 85 C0 74 1C EB 01 E8 81 FB F8 C0 A5 23 74 35 33 D2 56 6A 00 56 FF 75 4E FF D0 5E 83 FE 00 75 24 33 D2 8B 45 41 85 C0 74 07 52 52 FF 75 35 FF D0 8B 45 35 85 C0 74 0D 68 00 80 00 00 6A 00 FF 75 35 FF 55 3D 5B 0B DB 61 75 06 6A 01 58 C2 0C 00 33 C0 F7 D8 1B C0 40 C2 0C 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legacy Application Maintenance: An IT administrator manually runs a legacy internal tool (e.g., LegacyInventoryScanner.exe) that was packed with ASProtect v123 RC4 build 0807 to protect intellectual property or reduce file size. This often occurs during quarterly audits or when updating the tool’s configuration.
  • Filter/Exclusion: Exclude the specific file path (e.g., C:\CorpApps\Inventory\LegacyInventoryScanner.exe) or the specific SHA256 hash of the executable if it is a known, signed, and stable internal binary.
• Third-Party Vendor Agent Updates: A vendor’s management agent (e.g., VendorBackupAgent.exe or VendorDRClient.exe) is updated via a scheduled task or service restart. The new version of the agent is distributed in a packed state using ASProtect to prevent tampering, triggering the YARA rule upon execution or file change.
  • Filter/Exclusion: Exclude the vendor’s specific service name (e.g., VendorBackupSvc) or the parent process (e.g., svchost.exe if launched by a service, or the vendor’s updater process) if the vendor confirms the packing method.
• Antivirus/EDR Self-Test or Quarantine Release: An endpoint protection platform (e.g., CrowdStrike, SentinelOne, or Defender) performs a self-test or releases a previously quarantined file (which was packed with ASProtect) back into the active directory. The file execution or re-scan triggers the detection.
  • Filter/Exclusion: Exclude events where the parent process is the EDR agent (e.g., CrowdStrike.exe, SentinelOne.exe, MsMpEng.exe) or filter based on the file being located in a known quarantine or staging directory (e.g., `C:\ProgramData\EDR\