ASPAck 1061b

Hunt Hypothesis

This rule detects the execution of ASPack-packed executables, a common obfuscation technique used by threat actors to compress malware payloads and evade static analysis. Proactively hunting for these signatures allows the SOC to identify potentially hidden or obfuscated binaries that may be staging for further compromise or lateral movement within the environment.

YARA Rule

rule ASPAck_1061b: PEiD
{
    strings:
        $a = { 90 90 75 00 E9 }
    condition:
        $a at pe.entry_point

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legacy .NET Application Deployment via MSI/EXE Wrappers:

  • Scenario: IT teams deploying custom internal business applications (e.g., InvoicingPortal_v2.1.exe) that were compiled using older versions of the ASP.NET MVC framework or third-party packagers like Advanced Installer. These executables often retain the ASPack signature in their PE header due to the specific compression algorithm used by the packaging tool, even though the application is fully trusted and signed by the internal CA.
  • Filter/Exclusion: Exclude files located in standard application directories (e.g., C:\Program Files\InternalApps\, C:\Program Files (x86)\InternalApps\) that have a valid digital signature from the organization’s internal Code Signing Certificate (e.g., CN=Corp-CodeSign-Root) and are older than 30 days.

• Scheduled Backup Agent Updates:

  • Scenario: The enterprise backup solution (e.g., Veeam Backup & Replication or Commvault) performs scheduled agent updates on file servers. The update installer (VeeamAgentUpdate.exe or similar) is a self-extracting archive that uses ASPack compression for the payload. The YARA rule triggers on the temporary extracted binary or the installer itself during the weekly maintenance window (e.g., Sunday 02:00-04:00).
  • Filter/Exclusion: Exclude processes where the parent process is a known backup service (e.g., VeeamBackupSvc.exe, cvpd.exe) or where the file path contains \Backup\ or \Agents\ and the process start time aligns with the documented maintenance window.

• Third-Party Plugin/Extension Installation for IDEs:

  • Scenario: Developers installing or updating plugins for JetBrains IDEs (IntelliJ