General

  • Target

    NoErrorsAIO_v2.4.3_-_BEST_AIO_CHECKER.rar

  • Size

    10.1MB

  • Sample

    241009-aqb4taxcrd

  • MD5

    f7e46d41b1870bf9756f8283278f901a

  • SHA1

    56f67c8e095838252743e6a858d0baedb26cb6c0

  • SHA256

    9aa115b92758e82f4a4789d18430cddd2affd3f92e693d4e2fc74116a471dc5e

  • SHA512

    6b69a33d9eaf9950cdffdade7a5510b714306b2c294b3d1833f1291c9b5b32c9e3b2a865f29324be094d2908155c3ef14b8f29aa08322e892ca05d9c9a4e498c

  • SSDEEP

    196608:bUqOMC7KldIefMbmEfYtlQ79/2D4OID581uMjg9p1bPgLbM5mJiqDDoYHIV:bUncDIHmEgt6OUOIDVMEp1bPmb8OoLV

Malware Config

Targets

    • Target

      NoErrorsAIO v2.4.3 - BEST AIO CHECKER/NoErrorsAIO v2.4.3.exe

    • Size

      667.6MB

    • MD5

      6de57992d2f19017a5758b02f09a09b8

    • SHA1

      3aaa1a1954f68ac2e41e3d57ece6e011bcfa885e

    • SHA256

      8c590a5869c1db0d2a2048d4075910cbad1558de75496c2c6dab221b533ad33d

    • SHA512

      ee120ee6e205bfc1802c5329411c112e04f8a501972a8efef8f0abdcd1d5a4b481fd7f0851168fb3ad72ed6a6bf0d1f175f8a580a0ea43a5353aa3b296fcfc36

    • SSDEEP

      3072:V0CVWNiWoP/rKrYJG+3x2HagoSK7Jh+x8Zh96Rb3U72TD7aE2mBma:VwNiH/dG3Hax57g8g93U7OHaE2Om

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks