Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target

    aiosetup-main/Aio.bat

  • Size

    317B

  • MD5

    9b0795fdfd2e22cba5f76c7c67fa8b32

  • SHA1

    ef24c3a06ddbc5af6245675c85fcbd3877637ef3

  • SHA256

    031a007dd6876f29abb621afe3b760f6ca37cd0a58e2eabc52f3cae624d66653

  • SHA512

    52ad827c6f8b6110e2aa70865e3d40b72837c753e1c0597147f052514442c0dcd23131f6f4fea2f9e99593985f353136470be65d73c32a59150ba7c1ea944840

  Score

  10^/10

  defense_evasiondiscoveryexecutionpersistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Blocklisted process makes network request

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  behavioral1

• • Target

    aiosetup-main/EXM.exe

  • Size

    945KB

  • MD5

    09d7028997acf3507f20739e0c365b12

  • SHA1

    0552df362d8c8406ffd267cb3bcc378a21d00a24

  • SHA256

    348451bdc8893691e10bae17dfeeea520248e9b9aaa40cfbeaa2bb6b1b2f0f00

  • SHA512

    9aff98d41202bea02dd62fa00e1e795abd515e0a2d1580cd569fd02c027950f977096384459dfbcd0c32e4c032e4bf61df142e2f15d4d0f6b382c5d9013ce76a

  • SSDEEP

    24576:XtA4KdTztuUza4IcZ3KdXk22WYJVXvnG/CEvz:kdT8U+4IJXv2WYJ9vngvz

  Score

  1^/10
  behavioral2

• • Target

    aiosetup-main/HWID_Activation.cmd

  • Size

    72KB

  • MD5

    b3f7faced48b597184b8aa3d9c748d9a

  • SHA1

    33497679e14f387f882e8b28f20104b53f1e725c

  • SHA256

    d46e62b38d15acc44bfd745b1c008da26fa7d14d596c8380ae53b783cd9b1a61

  • SHA512

    c9db5973634b7e9da3ea2ad7327a582672da66fba7cbfd9bea693296b193672e84bca564ceb4c50060bf979f41613b43b5a2ef27dec42c32238186308dcebf18

  • SSDEEP

    1536:+I6R9PRsH4RqxHjEbYRflvdq+vKHFNdmu2/RYITFMGzi0gB0f6s:+I6RdRVR8Rb0FaRYIzOBQ

  Score

  4^/10
  behavioral3

• • Target

    aiosetup-main/aio.ps1

  • Size

    191B

  • MD5

    d2b0ff6d78afaea0b3cc0825c2c1f93a

  • SHA1

    54388d660c07bac16db6aff131f287ff12bd821e

  • SHA256

    81dbcb0ddc1a228c9ec000f5d78a5700fb65d45ce5622db7a3413c85dcd12fb2

  • SHA512

    c54c4a5151dd6a6b676b1986cefa80d6709e0d3e7ac1be5541e05b72899c6efb1871293c3d50a1b63a0b1858d1dc47a8e4db11fa7b12fe5110760d75fef893ef

  Score

  10^/10

  defense_evasiondiscoveryexecutionprivilege_escalation

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Legitimate hosting services abused for malware hosting/C2

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  behavioral4

• • Target

    aiosetup-main/rdst2.exe

  • Size

    13.7MB

  • MD5

    de34b1c517e0463602624bbc8294c08d

  • SHA1

    5ce7923ffea712468c05e7ac376dd9c29ea9f6be

  • SHA256

    ac96016f1511ae3eb5ec9de04551146fe351b7f97858dcd67163912e2302f5d6

  • SHA512

    114bca1ecd17e419ad617a1a4341e607250bcb02626cdc0670eb60be734bbad1f3c84e38f077af9a32a6b1607b8ce6e4b3641c0faefaa779c0fec0d3ac022dac

  • SSDEEP

    393216:/d/FlptVYmfr7yBG/4JU4TRjtjUMy4i6kgsY7i:/1PpttD7yBG/QHTJtYMyke9

  Score

  7^/10

  discovery

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral5

• • Target

    aiosetup-main/rdst3.exe

  • Size

    14.3MB

  • MD5

    f0248d477e74687c5619ae16498b13d4

  • SHA1

    9ed4b091148c9b53f66b3f2c69be7e60e74c486a

  • SHA256

    b6c82087a2c443db859fdbeaae7f46244d06c3f2a7f71c35e50358066253de52

  • SHA512

    0c373b06ffe84f3e803831e90f22d7d73304e47a47839db614f63399ff1b7fcf33153bf3d23998877c96d2a75e316291a219fdd12358ca48928526284b802591

  • SSDEEP

    393216:q5lptVYmfr7yBG/4WoI+j6LTinXKSf0fzTDv8:q7pttD7yBG/uljIinXj0fQ

  Score

  7^/10

  discovery

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral6

• • Target

    aiosetup-main/rdst4.exe

  • Size

    790KB

  • MD5

    694f54bd227916b89fc3eb1db53f0685

  • SHA1

    21fdc367291bbef14dac27925cae698d3928eead

  • SHA256

    b8f39714d41e009f75efb183c37100f2cbabb71784bbd243be881ac5b42d86fd

  • SHA512

    55bc0de75a7f27f11eb8f4ee8c9934dfe1acd044d8b7b2151c506bdcbead3ab179df7023f699c9139c77541bbc4b1c0657e93c34a6bc4309b665c6cb7636a7e5

  • SSDEEP

    12288:0s1yfEcpPzdv+t4cRIy3ze3SUN0PXGTjiqRy2p3kwzjGHTkV:NwfLrvi4cRIyDe3SUNaXy+WypoGHgV

  Score

  6^/10

  discovery

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops file in System32 directory

  behavioral7

• • Target

    aiosetup-main/rdst5.exe

  • Size

    281KB

  • MD5

    fd6057b33e15a553ddc5d9873723ce8f

  • SHA1

    f90efb623b5abea70af63c470daa8674444fb1df

  • SHA256

    111aeddc6a6dbf64b28cb565aa12af9ee3cc0a56ce31e4da0068cf6b474c3288

  • SHA512

    d894630c9a4bdb767e9f16d1b701acbdf011e721768ba0dc7a24e6d82a4d062a7ca253b1b334edba38c06187104351203a92c017838bdd9f13905cde30f7d94d

  • SSDEEP

    6144:pWK8EGMUjp5cGQ3Mek1B3B9h8Ins3i8AEYBSawz1YSc:JGvjp5cj35kDB9hrs3zARBSaJSc

  Score

  7^/10

  discoverypersistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral8

• • Target

    aiosetup-main/rdst6.exe

  • Size

    868KB

  • MD5

    53406e9988306cbd4537677c5336aba4

  • SHA1

    06becadb92a5fcca2529c0b93687c2a0c6d0d610

  • SHA256

    fa1afff978325f8818ce3a559d67a58297d9154674de7fd8eb03656d93104425

  • SHA512

    4f89da81b5a3800aa16ff33cc4a42dbb17d4c698a5e2983b88c32738decb57e3088a1da444ad0ec0d745c3c6b6b8b9b86d3f19909142f9e51f513748c0274a99

  • SSDEEP

    24576:+tW4x8xAxCdUcyezFSjaBHFaNlsqK5/oh6iZf1LUXw/vxNI:d4x8xqCGexm8FCspg0iZf1LUXD

  Score

  7^/10

  discovery

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral9

• • Target

    aiosetup-main/rdst7.msi

  • Size

    6.7MB

  • MD5

    97c2eebb30c5a88c68c8f24f37183f1d

  • SHA1

    49efdc29f65fc8263c196338552c7009fc96c5de

  • SHA256

    e6c41d692ebcba854dad4b1c52bb7ddd05926bad3105595d6596b8bab01c25e7

  • SHA512

    c9d1017b274ceb1b4ee624cf7e628787c32a727c64f715fbce1f1ae929d9114f8fe1291e34583cec615619b0128c01206b07efc878e7a5c57b792453f73fd0da

  • SSDEEP

    98304:wynfL329J1XswfXO6wiBB+4RZg6aENaCZAU5PMO0MntfERyJGH2YPq/:wYD3C1XXfzH+4cLHU5PM/Mnt+YGlq

  Score

  6^/10

  discoverypersistenceprivilege_escalation

  • Blocklisted process makes network request

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  behavioral10

• • Target

    aiosetup-main/rdst8.exe

  • Size

    5.5MB

  • MD5

    630d75210b325a280c3352f879297ed5

  • SHA1

    b330b760a8f16d5a31c2dc815627f5eb40861008

  • SHA256

    b06546ddc8ca1e3d532f3f2593e88a6f49e81b66a9c2051d58508cc97b6a2023

  • SHA512

    b6e107fa34764d336c9b59802c858845df9f8661a1beb41436fd638a044580557921e69883ed32737f853e203f0083358f642f3efe0a80fae7932c5e6137331f

  • SSDEEP

    98304:EuLgywiNHBeSLxYK/bxE3q/BlZkWMGPQflVJ/EK1sLyzs2T2Q1mOjq4/:V7wqheSVYK/bua/BlWWnuVhsus8nm+qi

  Score

  7^/10

  discovery

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral11

• • Target

    aiosetup-main/rdst9.exe

  • Size

    4.8MB

  • MD5

    b88228d5fef4b6dc019d69d4471f23ec

  • SHA1

    372d9c1670343d3fb252209ba210d4dc4d67d358

  • SHA256

    8162b2d665ca52884507ede19549e99939ce4ea4a638c537fa653539819138c8

  • SHA512

    cdd218d211a687dde519719553748f3fb36d4ac618670986a6dadb4c45b34a9c6262ba7bab243a242f91d867b041721f22330170a74d4d0b2c354aec999dbff8

  • SSDEEP

    98304:RuLgywiN1ah6HcG0UJrN7SDgndrHZDMeaNNjt0CKKBgY2r71pZ/APaOR72HgQo0z:I7wq1W6HqULS8djZDTaNNeCKVP5ORsg0

  Score

  7^/10

  discovery

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral12