ASProtectv123RC4build0807exeAlexeySolodovnikov

Hunt Hypothesis

This rule identifies the presence of the ASProtect v1.23 RC4 build 0807 executable, a known packer frequently used by threat actors to obfuscate malicious payloads and evade static analysis. Proactively hunting for this specific artifact in Azure Sentinel allows the SOC to detect potentially compromised endpoints or staged binaries before they execute, reducing the risk of undetected malware deployment.

YARA Rule

rule ASProtectv123RC4build0807exeAlexeySolodovnikov
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB [4] 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 D5 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }

condition:
		$a0
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legacy Application Updates: A critical line-of-business application (e.g., an older version of SAP GUI or a custom inventory management tool) uses ASProtect to pack its installer or updater executable to prevent tampering. When the IT team runs a scheduled maintenance job to update this specific application, the packed binary is written to disk and executed, triggering the YARA rule.

  • Filter/Exclusion: Exclude the specific file path where the legacy application is installed (e.g., C:\Program Files\LegacyApp\Updater\) or exclude the specific parent process (LegacyAppUpdater.exe) if it is a known, signed, and whitelisted binary.

• Third-Party Utility Installation: An administrator installs a specialized utility (e.g., a network packet analyzer or a legacy database backup tool) that bundles its core executable with ASProtect for obfuscation. The installation script extracts the packed executable to a temporary directory or the application folder, causing the detection to fire during the installation phase.

  • Filter/Exclusion: Exclude the specific installation directory (e.g., C:\Tools\PacketSniffer\) or add an exclusion for the known installer process (e.g., msiexec.exe or setup.exe) when the target file path matches the utility’s installation folder.

• Scheduled Backup/Compression Job: A scheduled task runs a custom backup script that uses a compression or encryption tool (e.g., a specific build of 7-Zip or a proprietary archive tool) that has its main executable packed with ASProtect to reduce size or protect IP. The scheduled job runs unattended, and the packed executable is loaded into memory, triggering the rule.

  • Filter/Exclusion: Exclude the specific scheduled task name (e.g., DailyBackupJob) or the specific user account running the job (e.g., svc_backup)