AIO[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
AIO.exe
Size 2.0MB
Sample260808-nt3mtswckc
SHA256 79438c89f1097f5fece636df5391476c071c5134326b9d1cfd6d081a7a72e65c
MD5 b471b5a05588c0c851078592d47aa2f5
SHA1 8570fa40d5d7006b85509504e1beaea3abc37cc9
SHA512 5a8243c0c7296c2660dabc5bbf6badd4425298203b09c060c0673380117cd28ee415f569132d644d9f2aa7b74b56520cf3253dfb122ca8ed8c738008ea073ea4
SSDEEP 24576:mUVVsDb+T88Va8ueVPcVkQv2e92XgvlPVE2qq2:LjlRQX9+
TLSH
T1C0A54BA9A11AD4F8E1DAAF3875D2CE82BFF1A9003B53136BD3484DB05E873916F36541
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
AIO.exe

File Explorer

AIO.exe

.exe 2.0MB

AIO.exe

IMPHASH 482a42d2f9a0f522d5286c3c0d73c780
SHA256 79438c89f1097f5fece636df5391476c071c5134326b9d1cfd6d081a7a72e65c
MD5 b471b5a05588c0c851078592d47aa2f5
SHA1 8570fa40d5d7006b85509504e1beaea3abc37cc9
SHA512 5a8243c0c7296c2660dabc5bbf6badd4425298203b09c060c0673380117cd28ee415f569132d644d9f2aa7b74b56520cf3253dfb122ca8ed8c738008ea073ea4
SSDEEP 24576:mUVVsDb+T88Va8ueVPcVkQv2e92XgvlPVE2qq2:LjlRQX9+
TLSH
T1C0A54BA9A11AD4F8E1DAAF3875D2CE82BFF1A9003B53136BD3484DB05E873916F36541
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Password

skibidi

Minor OS version

Major OS version

Entry point

131356

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winhttp

WinHttpOpenRequest WinHttpReceiveResponse WinHttpOpen WinHttpQueryDataAvailable WinHttpReadData WinHttpConnect WinHttpCloseHandle WinHttpSendRequest

ole32

CoCreateInstance CoTaskMemFree CoInitializeEx CoUninitialize

shell32

ShellExecuteA ShellExecuteExW SHGetFolderPathA

user32

AttachThreadInput ShowWindow BringWindowToTop GetAsyncKeyState SetActiveWindow GetForegroundWindow SetForegroundWindow GetWindowThreadProcessId

advapi32

RegDeleteValueA AdjustTokenPrivileges RegQueryValueExA GetUserNameA SetNamedSecurityInfoW GetNamedSecurityInfoW SetEntriesInAclW RegSetValueExA RegOpenKeyExA OpenProcessToken RegDeleteKeyA RegCreateKeyExA RegCloseKey LookupPrivilegeValueW FreeSid CheckTokenMembership AllocateAndInitializeSid

iphlpapi

GetAdaptersInfo

ws2_32

send setsockopt recv WSAStartup inet_pton bind listen htons connect closesocket __WSAFDIsSet select accept socket

kernel32

FlushFileBuffers GetFileType EnumSystemLocalesW GetConsoleOutputCP IsValidLocale GetLocaleInfoW LCMapStringW GetFileSizeEx SetFilePointerEx ReadConsoleW GetExitCodeProcess CreatePipe HeapReAlloc IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle HeapSize SetEndOfFile GetUserDefaultLCID CompareStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc HeapFree HeapAlloc GetCommandLineW GetCommandLineA FreeLibraryAndExitThread GetStdHandle CreateDirectoryA CreateFileW DeleteFileW GetDriveTypeW GetFileAttributesW GetFileSize GetLogicalDrives ReadFile SetFileAttributesW WriteFile CloseHandle GetLastError ResetEvent ReleaseMutex WaitForSingleObject CreateMutexA CreateEventA Sleep GetCurrentProcess ExitProcess GetCurrentThreadId GetModuleFileNameW LoadResource LockResource SizeofResource FindResourceW LocalFree CopyFileW MultiByteToWideChar WideCharToMultiByte GetConsoleMode SetConsoleMode WriteConsoleW SetConsoleCtrlHandler SetConsoleCP SetConsoleOutputCP SetConsoleTitleA GetConsoleWindow GetVolumeInformationA GetComputerNameA FormatMessageA GetLocaleInfoEx CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW GetFileInformationByHandle SetFileInformationByHandle RtlUnwind GetTempPathW AreFileApisANSI GetModuleHandleW GetProcAddress GetFileInformationByHandleEx EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx QueryPerformanceCounter ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WakeAllConditionVariable GetSystemTimeAsFileTime GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent TerminateProcess GetCurrentProcessId InitializeSListHead RtlPcToFileHeader RaiseException RtlUnwindEx SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW DuplicateHandle CreateProcessW GetModuleHandleExW CreateThread ExitThread

Name

.text

Size

279KB

Virtual Size

278KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

160KB

Virtual Size

159KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

AIO.exe

winhttp

ole32

shell32

user32

advapi32

iphlpapi

ws2_32

kernel32

generic