Extracted

• • Target

    aiosetup-main.zip

  • Size

    46.3MB

  • MD5

    18ee73828f04ecdcc8d686ef26cbf99a

  • SHA1

    3c11e0ba5ee79860ece1743b452bd804d3692379

  • SHA256

    df70f699036a080b6e48795b3e940377b4abf8e3869c30c5c102c1dffcef4045

  • SHA512

    b804e65d85ef00ff0b39dd07f453eec88907c45f1ed0bcf62698548b3f79cde3cb113d7e66ec0d33476880ba68568cbf975a10e74509d9fd3ed238211ca0a70a

  • SSDEEP

    786432:OmnYTFjhvhzajCtC7j3ZSUWIcqkUJpRvxu3kPR7XWudllYPMMvrf29jTrCy10X0M:LyFjhvhzaOtC7jwbGTJpRvxu0PBX5qyK

  Score

  10^/10

  microsoftdefense_evasiondiscoveryevasionexecutionphishingtrojan

  • UAC bypass

    evasiontrojan

  • Blocklisted process makes network request

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks for any installed AV software in registry

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Legitimate hosting services abused for malware hosting/C2

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion

  • Detected potential entity reuse from brand MICROSOFT.

    phishingmicrosoft

  • Drops file in System32 directory

  behavioral1