ASProtectv123RC4build0807dllAlexeySolodovnikov

Hunt Hypothesis

This hypothesis targets the presence of the ASProtect v1.23 RC4 build 0807 DLL, a specific version of a commercial packer frequently abused by threat actors to obfuscate malicious payloads and evade static analysis. Proactively hunting for this artifact in Azure Sentinel allows the SOC to identify potentially compromised hosts or staging environments where attackers are using this known tool to hide their code execution or persistence mechanisms.

YARA Rule

rule ASProtectv123RC4build0807dllAlexeySolodovnikov
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 [3] 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 D5 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legacy .NET Application Deployment (e.g., WinForms/WPF Apps)

  • Scenario: A development team deploys a custom internal line-of-business application (e.g., InventoryTracker.exe) that was compiled using the ASProtect v123 RC4 build to protect intellectual property or reduce file size. The YARA rule matches the specific version string and build date embedded in the DLL/EXE header, triggering an alert during the standard software distribution via SCCM or Intune.
  • Filter/Exclusion: Create an allowlist for the specific application path (e.g., C:\Program Files\InventoryTracker\InventoryTracker.exe) or exclude the process name InventoryTracker.exe if it is consistently signed by the internal corporate code-signing certificate.

• Third-Party Vendor Tooling (e.g., Antivirus or Backup Agents)

  • Scenario: A vendor-provided agent, such as a specific version of a backup client (e.g., VeeamAgent.dll) or a niche security tool, uses the ASProtect v123 RC4 build for its core library. During a routine patch Tuesday update or a scheduled full backup job, the agent loads the protected DLL, causing the YARA rule to fire on the host where the agent is installed.
  • Filter/Exclusion: Exclude the specific vendor’s service executable (e.g., VeeamSvc.exe) or the specific DLL path (e.g., C:\Program Files\Veeam\Backup\Agent\bin\VeeamAgent.dll) from the YARA scan scope if the vendor confirms the use of this specific ASProtect build.

• Scheduled Maintenance Job (e.g., Database Index Rebuild)

  • Scenario: A scheduled task runs a custom utility script (e.g., DBIndexOptimizer.exe) that links against a statically protected library