ASProtectSKE21xexeAlexeySolodovnikov

Hunt Hypothesis

This hunt detects the execution of binaries protected by the ASPack packing tool, specifically targeting variants associated with Alexey Solodovnikov that may be used to obscure malicious code from static analysis. A SOC team should proactively hunt for these instances in Azure Sentinel because packed executables often evade signature-based detection and can serve as a precursor to advanced threats like fileless malware or staged attacks within the environment.

YARA Rule

rule ASProtectSKE21xexeAlexeySolodovnikov
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 [3] 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 ED 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }

condition:
		$a0
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the ASProtectSKE21xexeAlexeySolodovnikov detection rule, along with targeted filters and exclusions:

• Scenario: Deployment of Enterprise Endpoint Protection Agents

  • Context: The organization utilizes a major security suite (e.g., Kaspersky Endpoint Security or ESET) that employs ASProtect to package its installer (setup.exe or agent_installer.exe). When the IT team runs a mass deployment via SCCM or Intune, the YARA rule triggers on the protected executable payload.
  • Filter/Exclusion: Add a path-based exclusion for the specific installation directory of the endpoint protection suite (e.g., C:\Program Files\Kaspersky Lab\*) and exclude the process name kavsetup.exe or eset_install.exe from triggering this rule.

• Scenario: Execution of Licensed Third-Party Business Applications

  • Context: Critical line-of-business applications (such as a specialized ERP module, CAD software like AutoCAD, or financial tools like SAP) often use ASProtect for license enforcement and anti-tampering. When users launch these applications during peak business hours, the rule fires on the main executable (app_core.exe or similar).
  • Filter/Exclusion: Implement a whitelist based on the Publisher certificate hash. Create an exclusion for executables signed by the specific vendor’s code signing certificate (e.g., “SAP SE” or “Autodesk, Inc.”) regardless of the ASProtect signature presence.

• Scenario: Scheduled Maintenance and Backup Jobs

  • Context: A nightly scheduled task runs a custom backup utility or database maintenance script that has been wrapped with ASProtect to prevent unauthorized modification. The job triggers at 02:00 AM, causing the detection engine to flag the protected `maintenance_job