ASProtect v123 RC4 build 0807 dll Alexey Solodovnikov h additional

Hunt Hypothesis

This hypothesis targets the presence of ASProtect v123 RC4 build 0807 DLLs, a specific version of a commercial packer frequently abused by threat actors to obfuscate malicious payloads and evade static analysis. Proactively hunting for this indicator in Azure Sentinel allows the SOC to identify potentially compromised endpoints or staging areas where attackers are using this known tool to hide their code, enabling early detection before the packed executable is executed or further propagated.

YARA Rule

rule ASProtect_v123_RC4_build_0807_dll_Alexey_Solodovnikov_h_additional: PEiD
{
    strings:
        $a = { 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 D5 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 B8 F8 C0 A5 23 50 50 03 45 4E 5B 85 C0 74 1C EB 01 E8 81 FB F8 C0 A5 23 74 35 33 D2 56 6A 00 56 FF 75 4E FF D0 5E 83 FE 00 75 24 33 D2 8B 45 41 85 C0 74 07 52 52 FF 75 35 FF D0 8B 45 35 85 C0 74 0D 68 00 80 00 00 6A 00 FF 75 35 FF 55 3D 5B 0B DB 61 75 06 6A 01 58 C2 0C 00 33 C0 F7 D8 1B C0 40 C2 0C 00 }
    condition:
        $a at pe.entry_point

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are specific false positive scenarios for the YARA rule targeting ASProtect v123 RC4 build 0807 (specifically the DLL variant associated with Alexey Solodovnikov’s work), along with recommended filters:

• Legacy 32-bit Application Deployment via GPO or SCCM

  • Scenario: An enterprise deploys a legacy 32-bit line-of-business application (e.g., an old ERP client or specialized industrial HMI software) that was compiled and packed with ASProtect v123 RC4 build 0807. The application installer or the final *.dll file is copied to C:\Program Files (x86)\[AppName]\ or C:\Windows\SysWOW64\ during a scheduled maintenance window.
  • Filter/Exclusion: Exclude files located in known legacy application directories (e.g., C:\Program Files (x86)\[SpecificApp]\) or exclude files with specific known-good hashes (SHA256) of the legacy DLLs. Additionally, exclude files owned by the NT SERVICE\SCCM or NT AUTHORITY\SYSTEM account during deployment windows.

• Third-Party Anti-Virus or Endpoint Protection Driver/Helper DLLs

  • Scenario: Certain older or niche endpoint protection agents, or specific hardware driver packages (e.g., for legacy PLCs, scanners, or financial terminals), bundle a helper DLL that has been packed with ASProtect v123 RC4 build 0807 to protect intellectual property or reduce size. These DLLs are loaded into memory by the service host (svchost.exe or a specific vendor service) during system boot or service start.
  • Filter/Exclusion: Exclude DLLs located in vendor-specific driver or agent directories (e.g., `C:\Program