PUA:Win32/Packunwan Wacatac.H!ml

[wynford]

I got the same thing a few minutes ago with Windows Security on Windows 11, so I added the folder to exclusions. Been using 5.4.0.2716 since it came out a week ago. What's different in the repacking?

[Artem]

What's different in the repacking?

Different signature. Now Microsoft Defender does not detect anything: https://www.virustotal.com/gui/file/6f5a68d28b33da6da1a775ccbe4bdfa661d2db3632617ef299941e625a13cf91?nocache=1

[osmiber]

Hi.

I've been using AIMP for years without problems and with great joy, so I suppose that it is a false positive. While updating from AIMP 5.40.2721 (june 23) to 5.40.2722 (july 01) using the internal AIMP autoupdater, Trellix detected this:

T1204.002 ******\++++ ran C:\Users\++++\AppData\Roaming\AIMP\UpdateInstaller.exe, which attempted to access C:\Program Files\AIMP\Uninstall.exe. The Trojan named Artemis!891B0FC8C7A7 was detected and deleted.

T1204.002 ******\++++ ran C:\Program Files\AIMP\AIMP.exe, which attempted to access C:\Users\++++\AppData\Local\Microsoft\Windows\INetCache\IE\WE2Z40YM\aimp_5.40.2722_w64[1].exe. The Trojan named Artemis!891B0FC8C7A7 was detected and deleted.

Please, could you kindly verify that there is no concern with the mentioned versions? Thanks a lot.

[Soolo]

https://aimp.ru/forum/index.php?topic=67289.0

https://www.virustotal.com/gui/file/f3afc3c39cc8c48416d983f0dd715fd092e24aee3c108ba7064854afcba34d2d

[osmiber]

Thank you Soolo, but the post that you mentioned does not talk about the versions mentioned on my post.

The newest version discussed in your post is from April, but the versions I mentioned are from June and July.

As I can see, this seems to be a recurring issue, but my concern is with the last 2 versions; for years (and many computers), McAfee/Trellix never detected anything while updating AIMP and there have been "attacks" with other software autoupdates, I think that recently notepad++ repository was "attacked" and the autoupdate was installing a version with malware.

It is also strange that 5.40.2721 is not included in the Change Log for desktop versions in https://aimp.ru/?do=changelog&os=desktop (It jumps from 5.40.2716 to 5.40.2722)

So I posted this behavior in case someone knows something about 5.40.2721 and 5.40.2722.

[Artem]

It is also strange that 5.40.2721 is not included in the Change Log for desktop versions in https://aimp.ru/?do=changelog&os=desktop (It jumps from 5.40.2716 to 5.40.2722)

I do not maintain a change log for intermediate versions and hotfixes