ASPackv104bAlexeySolodovnikov

Hunt Hypothesis

This hypothesis targets the presence of ASPack v1.04b packed executables, a specific variant of the ASPack packer often used by threat actors to compress and obfuscate malicious payloads to evade static analysis. Proactively hunting for this signature in Azure Sentinel allows the SOC team to identify potentially compromised endpoints or suspicious artifacts that may have been introduced via phishing or supply chain attacks, ensuring early detection of low-severity threats that could serve as initial access vectors.

YARA Rule

rule ASPackv104bAlexeySolodovnikov
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 [4] 5D 81 ED [4] B8 [4] 03 C5 2B 85 ?? 12 9D ?? 89 85 1E 9D [2] 80 BD 08 9D }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A developer or DevOps engineer uses the ASPack v1.04b packer to compress and protect a custom C++ utility or CLI tool before deploying it to production servers to reduce binary size and obfuscate internal logic.
  • Filter/Exclusion: Exclude files located in specific build artifact directories (e.g., C:\Builds\Release\bin\ or C:\Artifacts\) or exclude binaries owned by service accounts associated with CI/CD pipelines (e.g., svc-cicd, build-agent).
• Scenario: An IT administrator deploys a legacy line-of-business application that was compiled and packed with ASPack years ago to maintain compatibility with older Windows versions, and the binary is copied to the C:\Program Files\LegacyApp\ directory during a scheduled GPO software deployment.
  • Filter/Exclusion: Exclude paths under C:\Program Files\ or C:\Program Files (x86)\ for known legacy application names (e.g., LegacyApp.exe) or exclude files with a specific version string in their metadata that matches the known legacy build.
• Scenario: A security team or QA engineer tests a new internal microservice by manually packing it with ASPack to verify how the EDR detects packed binaries, placing the test file in a temporary directory like C:\Temp\QA-Tests\ or C:\Users\qa-admin\AppData\Local\Temp\.
  • Filter/Exclusion: Exclude files located in standard temporary directories (C:\Temp\, C:\Users\*\AppData\Local\Temp\) or exclude files created by users with the QA-Admin or Security-Test group membership.
• Scenario: A third-party vendor provides a small, optimized installer or agent binary that uses ASPack for compression