← Back to SOC feed Coverage →

Disclosed hacktool set (old stuff) - file ASPACK.EXE

yara HIGH Yara-Rules
community
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Yara-Rules →
Retrieved: 2026-07-30T11:00:00Z · Confidence: medium

Hunt Hypothesis

This detection identifies adversaries leveraging legacy hacking tools packaged within the ASPACK.EXE executable to establish a persistent foothold or execute malicious payloads on endpoints. Proactive hunting for this specific artifact in Azure Sentinel is critical because older tooling often lacks modern security signatures, making it an ideal vector for stealthy attacks that may bypass standard real-time defenses.

YARA Rule

rule ASPack_ASPACK {
	meta:
		description = "Disclosed hacktool set (old stuff) - file ASPACK.EXE"
		author = "Florian Roth"
		date = "23.11.14"
		score = 60
		hash = "c589e6fd48cfca99d6335e720f516e163f6f3f42"
	strings:
		$s0 = "ASPACK.EXE" fullword wide
		$s5 = "CLOSEDFOLDER" fullword wide
		$s10 = "ASPack compressor" fullword wide
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

This rule contains 3 string patterns in its detection logic.

False Positive Guidance

Here are 5 specific false positive scenarios for the Disclosed hacktool set (old stuff) - file ASPACK.EXE detection rule, along with recommended filters and exclusions:

Original source: https://github.com/Yara-Rules/rules/blob/main/malware/TOOLKIT_THOR_HackTools.yar