AspirePacker

rule aspire_packer_bin
{
    meta:
        description = "Packer"
        author = "James_inthe_box"
        reference = "39a96d2c2929ba6f63a9226f87d88c3a9692b86cf23a917d94b7c0ba76995400"
        date = "2020/20"
        maltype = "Packer"

    strings:
        $string2 = "AspireMAIN" ascii
        $string3 = "foolder" ascii

    condition:
        uint16(0) == 0x5A4D and all of ($string*) and filesize < 800KB
}

rule aspire_packer_mem
{
    meta:
        description = "Packer"
        author = "James_inthe_box"
        reference = "39a96d2c2929ba6f63a9226f87d88c3a9692b86cf23a917d94b7c0ba76995400"
        date = "2020/20"
        maltype = "Packer"

    strings:
        $string2 = "AspireMAIN" ascii
        $string3 = "foolder" ascii

    condition:
        all of ($string*) and filesize > 800KB
}

87878ea8c78bef7d998477f58a91ba1ed5e84538
36efe32dc421c4b8d4b25247fee891d169e812b4
60727ce38d77949cb7650f9c69affcc38dcf5136
1acd6f464c643591db06d31f778c9fbc288f5129
99f6813592680a485eecb05641fc435567e2e089
23e04d8f7a984a19a78c02bcd19a90f570878dd4
96b895fd6ce551eb4cad2b0c2cd005f044099629
dd2e8102192f8fdb4a9f6e7c51a35d79f585c62d
f929f65edfff64585c5c3991ae29fbbdb5a629cc
40b46d15590a3c8820c37d9daab5eef3081ce03f
85552f74228f35bd76146fd84790064878b7b2da
78b4791c900164c5bda21fe035e7d08a59c68365
4b927d943c5a1eb9e002c29eb8657ae7d8246309
e5c322c30f1bb6e9747dc1cd3bbcf34c3e8c2eda
dfc4e441f3a7499f2c2a8aff2515a4e756769134
9467f35cc13be09a11f8ae9a39e9213baf6de982
aaaab632add2e2d1bf65deb0b6403b8cbb4eaa72
e0de7f1c60638cc00a22bb21bd1bb98905d4a4de
b432e832b3172610f65e01eab3b9aefddc994945
69f34ef31cfea89ac9e4bdc38220519fabe09ee8
37745fce368601db8b6f0be308cfaf1df0bd15ea
f2d13947dbc4ca8ef889d54b61de2733cc20a134
415bee7ef67e752841f7e3abbad55e3698954441
afacbb443f67ab241a8e1f36f255a75732530929
182f0b7db203974a24228d7e0b007d5b8c410aeb
0b9344999e3e658634d2cd3a81ee11c33f72e352
dcaa9e5e2cddb95485845eda14871cf49c471945
bdad91122725163db2f8fc5b6e8f0afcfaf550b1
ddc27fe130f82d170dae17bf2f4d0816ab3c16da
ece0cbbd807cc90d7c3443d773e527b80e838218
aa9d5d4df84b179db36482316c6a927c3a903275
50f9a7d77584d5ffa0063012f289b156a4cce488
58199f92fdb28238685eda6274000cdb856f7123
668c465a04111c5e7e7bf1cab0c11366d6f635fb
5fc89bef404b9b4d12e9d01aa2d3ebe3710a312a
0ae6b4dccd9b9299520f6808b29f03b33c9767ea
822c844fbd78baadb104d8444f6725999f071ed3
b60e0dbc35f45e3962b297e63a43d3da42316865
dd26626032633a0aaa6228fd5bed84d7c9283700
0a43fe8a7e65b7ed20c911d9a2ee9befae72365c
154f248fd17ba32f112aae05690d180f467b5320
75fa2784a3f616fbfb8611c0ecda9bcc621c5fd2
a22fe6f76413ae7d950c7d7a53dfa7a7c5a8d380
cc19619f692b49c316a8afb057ac147fef9cf87d
6e709c2ad730c54fcc8dfbc6194e1bbdab9940bf
5e15edd7c9f55016be72bca8c356f1d243d7be25
9dac64905477895771ca05eb6f168009a80bd95c
438d5db820af74e3f636c1c613d0653eb26118cb
d9f8c2a4ae1315341352e7991de2dd286372580d
ce754a315e3c7b13d18d00b92da077fb470fa7bb
7af9f222c7b8055f5aac3c7bac2e5f69eda3902b
6d02d0b16405fbf0b1e9a5b804b4a4b99b7fd337
d78c495cb49bbb7c89589a6433f36abe641d60f6
086c04ea7350a64d7f2bd9cd891006d200b323c8
a991f1208a89d3572c035a8768fededd87dffb54
7df8136bbd80f74d117e6bf544ece3520e9e575e
0fd18c46fff1f9cedb2b013d6497f37f41db6a08
248b9f90d221ef5e50760e368cacd7c3184e8718
46e4029fc2c37da4b22320a7d42fcceb1ff3de88
9e40bd85d3ae29a3264a9d3d492ad65dda00da82
81787559ecce8219a402501d8c9ea1b159a62c3f
5e0def9c04b1be005f7275f476b845ecb8fd25ee
c42aa8de9afb55b0cdc924ea6b53ec74ba61a673
d517029e606273abe80ba79a61244ef1250cc91f
37be5e1e94b2325161e15cc9b8ab7d54dc06d34d
989e3cd6acf77cbb3db0a88eaeff847848fb8b1e
3b6eaaec22faefd6cfd73d15dab87d5076d93471
1cbca49df578096be5e2125f10cae890ca5593ac
19d60d21f6bfa5fa0ab6c8b9797d894e223c1cc3
2afa90e20cb02fe6fc870ccc3747f6f7917087cb
5ff3aa49647b4f22ede110e5be665595dba3de05
eec536191863ba8eb664402dc350955a16e07047
cbc7c7acd103b5e11ff360f3e784d9018a2062cb
36a7f6e47aa31d1b62364c706d8280f33da8fe62
2f514e8346f2317882cf3bcea6d051d3ef9ea9c4
023b22b43a367ddfd60293cee9e7fdf96d758d2b
4c14feb730f8ecaa8315a7e3793f0eb438cc46bd
fa6cbabc6f59c22fa1a06344e77c8a28e2042bb5
74b20f6e0b75de9f33df2b7aa926946f781198e6