Overview
overview
3Static
static
3XiaomiFire....9.rar
windows10-2004-x64
1XiaomiFire....9.rar
windows11-ltsc_2024-x64
1AdbWinApi.dll
windows10-2004-x64
3AdbWinApi.dll
windows11-ltsc_2024-x64
3AdbWinUsbApi.dll
windows10-2004-x64
3AdbWinUsbApi.dll
windows11-ltsc_2024-x64
3XiaomiFire....9.exe
windows10-2004-x64
3XiaomiFire....9.exe
windows11-ltsc_2024-x64
3config.ini
windows10-2004-x64
1config.ini
windows11-ltsc_2024-x64
1libcurl.dll
windows10-2004-x64
3libcurl.dll
windows11-ltsc_2024-x64
3Analysis
- max time kernel
148s - max time network
136s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
27/07/2026, 17:20
Static task
static1
Behavioral task
behavioral1
Sample
XiaomiFireTool 2.9.rar
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
XiaomiFireTool 2.9.rar
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral3
Sample
AdbWinApi.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
AdbWinApi.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral5
Sample
AdbWinUsbApi.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral6
Sample
AdbWinUsbApi.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral7
Sample
XiaomiFireTool 2.9.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral8
Sample
XiaomiFireTool 2.9.exe
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral9
Sample
config.ini
Resource
win10v2004-20260513-en
Behavioral task
behavioral10
Sample
config.ini
Resource
win11ltsc2024-20260710-en
Behavioral task
behavioral11
Sample
libcurl.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral12
Sample
libcurl.dll
Resource
win11ltsc2024-20260709-en
General
- Target XiaomiFireTool 2.9.rar
- Size 31.7MB
- Sample260727-vwvtbsxeqf
- SHA256 d0b261ba10eee0435f7b74ee44d6f2eff0620dc4d6364a9e4efb9e2bf452ca3c
- MD5 344c811133931316c674e4b112f27f5f
- SHA1 3c1591a007d696fd5f7c9356f1f5622f62dab5be
- SHA512 37670b09cc9e6b48fffc05340ace39f43e23652a09e3028ebcf19b257bf3ec4859873694123d66edc013dd8f06750bf06385861ae6c01d03c0e0fd0ff1b1965a
- SSDEEP 786432:k672C+N6O/sDpGA5C+FD1e9R65d9Grv827gkfjQ6zga/:pCVvKr53ebud9Iv827gk7Q6ka/
- TLSH T1A77733D0C537221E5E40B720F28DCAF9E4EDDDCB5E65D2472AA761311EE2A23F04C16A
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ 7zFM.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1192 7zFM.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeRestorePrivilege 1192 7zFM.exe Token: 35 1192 7zFM.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1192 7zFM.exe