ASPack 108

Hunt Hypothesis

This rule identifies executable files packed with the ASPack 108 compression algorithm, a technique frequently used by threat actors to reduce binary size and evade static analysis during initial access or lateral movement. Proactively hunting for these packed binaries in Azure Sentinel allows the SOC to uncover hidden payloads or trojans that may have been deployed on endpoints, ensuring that compressed malware is detected before it can execute or propagate within the environment.

YARA Rule

rule ASPack_108: PEiD
{
    strings:
        $a = { 90 90 90 75 01 90 E9 }
    condition:
        $a at pe.entry_point

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legacy Application Deployment via Group Policy: When IT administrators deploy older, unmanaged line-of-business applications (e.g., specific versions of legacy ERP or CAD software) that were compiled with ASPack 108 to reduce file size, the binary may trigger the rule during initial deployment or re-imaging.
  • Filter/Exclusion: Exclude files located in standard application installation directories (e.g., C:\Program Files\LegacyApp\bin\) or specific known-good hashes of the legacy executables.
• Third-Party Driver or Firmware Updates: Certain hardware vendors (e.g., older printer drivers, RAID controller utilities, or specialized industrial hardware tools) may ship with ASPack-packed binaries to minimize download size. These are often executed by scheduled tasks or service control managers during update cycles.
  • Filter/Exclusion: Exclude processes initiated by known vendor update services (e.g., vuprgrui.exe for HP, dellupdatemgr.exe) or binaries located in vendor-specific driver folders (e.g., C:\Windows\System32\drivers\ or C:\ProgramData\VendorName\).
• Backup and Restore Operations: During backup verification or restore drills, backup software (e.g., Veeam, Commvault, or Acronis) may temporarily unpack or execute ASPack-compressed archives or restore legacy application binaries to temporary directories for integrity checks.
  • Filter/Exclusion: Exclude files located in temporary directories associated with backup agents (e.g., C:\ProgramData\Veeam\Backup\ or C:\Temp\Commvault\) or processes spawned by known backup agent executables.
• Software Licensing or Activation Services: Some older licensing servers or activation tools (e.g., FlexLM, older versions of Keyshot, or specific PLM tools) use ASPack packing for their licensing