Static task
static1
Behavioral task
behavioral1
Sample
Xiaomi NOT VPN METHOD/NewMethod.bat
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Xiaomi NOT VPN METHOD/NewMethod.bat
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
Xiaomi NOT VPN METHOD/OLDMethod.bat
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
Xiaomi NOT VPN METHOD/OLDMethod.bat
Resource
win10v2004-20230221-en
Behavioral task
behavioral5
Sample
Xiaomi NOT VPN METHOD/sfk.exe
Resource
win7-20230220-en
Behavioral task
behavioral6
Sample
Xiaomi NOT VPN METHOD/sfk.exe
Resource
win10v2004-20230220-en
General
-
Target
Xiaomi NOT VPN METHOD.zip
-
Size
640KB
-
MD5
35dac4df5ad88ac13d493a2237ec8f4b
-
SHA1
a1d0713fddc9b990303764646fa95327f9d7affa
-
SHA256
04a492adf5cd10016618f79678beaca5ebde8f0d320e7d8d9f6a3ddd0324c169
-
SHA512
106a403214aab1d2905c43b606337af27c7c2751502efc106b49007393980abc937ff9eb5777cd8706e23de9d799fbc9865f87ef253861d8586b40d41d2dd2c9
-
SSDEEP
12288:9WO4cZB4QxfctRjxDoZitQUBBekVcrYMdxphf7CTDL8t7KB4HVLKC8QE9:R4uB4QKjxD4ajeuitx57s6LKC8QK
Malware Config
Signatures
Files
-
Xiaomi NOT VPN METHOD.zip.zip
-
Xiaomi NOT VPN METHOD/NewMethod.bat
-
Xiaomi NOT VPN METHOD/OLDMethod.bat
-
Xiaomi NOT VPN METHOD/sfk.exe.exe windows x86
dda464d36d6fc9beb4aad1ab987dddd9
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetStdHandle
LocalFree
FormatMessageA
GetCurrentProcessId
GetDiskFreeSpaceExA
GetVolumeInformationA
LocalFileTimeToFileTime
SystemTimeToFileTime
ReadFile
VirtualAlloc
ReadConsoleInputA
PeekConsoleInputA
GetNumberOfConsoleInputEvents
CopyFileExA
GlobalUnlock
GlobalLock
GlobalAlloc
VirtualFree
GetModuleFileNameA
LoadLibraryA
CreateFileW
GetVersion
SetEndOfFile
SetFilePointer
DosDateTimeToFileTime
GetLocalTime
GetFullPathNameA
FindFirstFileA
FindNextFileA
FindClose
SetVolumeLabelA
GetDriveTypeA
GetLocaleInfoA
GetConsoleScreenBufferInfo
FileTimeToSystemTime
FileTimeToLocalFileTime
SetConsoleMode
GetConsoleMode
lstrcpynA
LeaveCriticalSection
lstrcmpiA
EnterCriticalSection
lstrlenA
InitializeCriticalSection
ReleaseMutex
WaitForSingleObject
CreateFileA
CreateMutexA
HeapFree
HeapAlloc
GetProcessHeap
GetCurrentProcess
CreateProcessA
GetExitCodeProcess
RtlUnwind
GetCurrentThreadId
GetCurrentDirectoryW
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetCPInfo
GetOEMCP
GetACP
GetStringTypeW
GetStringTypeA
GetEnvironmentStringsW
GetFileTime
SetConsoleCtrlHandler
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
HeapSize
VirtualQuery
GetSystemInfo
VirtualProtect
SetEnvironmentVariableW
FlushFileBuffers
SetCurrentDirectoryA
GetFullPathNameW
LCMapStringW
LCMapStringA
WriteFile
UnhandledExceptionFilter
GetTimeZoneInformation
WideCharToMultiByte
GetStartupInfoA
SetHandleCount
HeapCreate
HeapDestroy
GetFileType
SetStdHandle
MultiByteToWideChar
HeapReAlloc
GetVersionExA
SetFileTime
CloseHandle
GetFileAttributesW
GetFileAttributesA
GetLastError
SetConsoleTextAttribute
ExitProcess
GetFileAttributesExA
SetFileAttributesA
Sleep
QueryPerformanceFrequency
QueryPerformanceCounter
InterlockedExchange
GetTickCount
GetCommandLineA
RemoveDirectoryA
GetProcAddress
GetModuleHandleA
TerminateProcess
GetSystemTimeAsFileTime
DeleteFileA
GetDriveTypeW
FindFirstFileW
MoveFileA
MoveFileW
FindNextFileW
GetCurrentDirectoryA
GetTimeFormatA
GetDateFormatA
CreateDirectoryA
user32
ReleaseDC
GetWindowDC
GetDesktopWindow
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
MessageBeep
GetClipboardData
IsClipboardFormatAvailable
CharToOemA
OemToCharA
MessageBoxA
gdi32
GetDeviceCaps
ws2_32
send
recv
inet_addr
socket
sendto
connect
gethostbyname
inet_ntoa
ntohs
shutdown
closesocket
WSAStartup
htons
WSACleanup
listen
getsockname
bind
setsockopt
htonl
ioctlsocket
gethostname
accept
WSAGetLastError
__WSAFDIsSet
recvfrom
select
advapi32
LookupPrivilegeValueA
AdjustTokenPrivileges
GetSecurityDescriptorControl
GetKernelObjectSecurity
SetKernelObjectSecurity
IsValidSecurityDescriptor
GetSecurityDescriptorDacl
IsValidAcl
GetSecurityDescriptorSacl
GetSecurityDescriptorOwner
IsValidSid
GetSecurityDescriptorGroup
OpenProcessToken
shell32
ShellExecuteA
Sections
.text Size: 1020KB - Virtual size: 1018KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 500KB - Virtual size: 496KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 442KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE