HomeWayVPN[.]zip | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
HomeWayVPN.zip
Size 27.9MB
Sample260808-plvspade29
SHA256 f399ec22511c30814e845204909fc445fc5f816cad90902d76fd7371fdfa9c5c
MD5 f0e14cd7bde94c5f8f871652d27a2e5b
SHA1 9f3bdc491b71b1e68e047491cb06b3a1e7fc1a97
SHA512 66ded3af8656820f80987decda6fe320ddd07819dfa5dfe12e80e8baf13d1578ea3e7a339ee9f18fbe5b7b2e0fb963054d26ecf98129e39abf0697b72d7cbf4e
SSDEEP 786432:XdaHz9ODLsODkBj52I7nR4JvLyihm9/AWPih9ktEFBf5i:29OFkBj5bR4dOIF9ktEjf5i
TLSH
T1B757335DA3397897B4F94A7E18479AC5CF49032F2E7C907A8248BD48148BC66D3D4BF2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 5 IoCs

Checks for missing Authenticode signature.

resource
unpack001/HomeWayVPN\HomeWayVPN.exe
unpack001/HomeWayVPN\flutter_windows.dll
unpack001/HomeWayVPN\mihomo.exe
unpack001/HomeWayVPN\url_launcher_windows_plugin.dll
unpack001/HomeWayVPN\watchdog.exe

File Explorer

HomeWayVPN.zip

.zip 27.9MB
HomeWayVPN\HomeWayVPN.exe

.exe 111KB
HomeWayVPN\data\app.so

.elf 5.3MB
HomeWayVPN\data\flutter_assets\AssetManifest.bin

2B
HomeWayVPN\data\flutter_assets\AssetManifest.json

2B
HomeWayVPN\data\flutter_assets\FontManifest.json

82B
HomeWayVPN\data\flutter_assets\NOTICES.Z

.gz 83KB
NOTICES.Z

1.7MB
HomeWayVPN\data\flutter_assets\fonts\MaterialIcons-Regular.otf

1.6MB
HomeWayVPN\data\flutter_assets\shaders\ink_sparkle.frag

16KB
HomeWayVPN\data\icudtl.dat

760KB
HomeWayVPN\flutter_windows.dll

.dll 17.3MB
HomeWayVPN\mihomo.exe

.exe 47.0MB
HomeWayVPN\url_launcher_windows_plugin.dll

.dll 96KB
HomeWayVPN\watchdog.exe

.exe 22KB

HomeWayVPN.zip

SHA256 f399ec22511c30814e845204909fc445fc5f816cad90902d76fd7371fdfa9c5c
MD5 f0e14cd7bde94c5f8f871652d27a2e5b
SHA1 9f3bdc491b71b1e68e047491cb06b3a1e7fc1a97
SHA512 66ded3af8656820f80987decda6fe320ddd07819dfa5dfe12e80e8baf13d1578ea3e7a339ee9f18fbe5b7b2e0fb963054d26ecf98129e39abf0697b72d7cbf4e
SSDEEP 786432:XdaHz9ODLsODkBj52I7nR4JvLyihm9/AWPih9ktEFBf5i:29OFkBj5bR4dOIF9ktEjf5i
TLSH
T1B757335DA3397897B4F94A7E18479AC5CF49032F2E7C907A8248BD48148BC66D3D4BF2
MD5 SHA1 SHA512 SSDEEP TLSH

HomeWayVPN\HomeWayVPN.exe

IMPHASH 02a5366b8efb2c8f19c86296c85a946e
SHA256 0e91e7fb0c43654e7cfb23bf7269e4a25b6b18c457967cf8b578d3257aed9643
MD5 b282af627401bff74e04c7e3a4482c13
SHA1 df52fa7d0a9c67b4d65e9a9a879854c9d5b4d80e
SHA512 f9a50a98efb357e905bb087a1a60c8f8bccd844b4b2e3d199da3ad2e6465c9102b95973735205c7a836b214c97dd088600fb3d80aeec70de9a3cb571206a0e0e
SSDEEP 1536:i4oGGpXb8PFxPjcf6iMfxoFhZGsb8+tJT3me/NrjG6QW+tuFrie1n1T:i4oRb8PFxm6/ZBsb8yZme/NXUWOu91T
TLSH
T1C8B37D2BEB5950EAE21AC939CA438906CB71BC9647919BCF5B500E970F27ED44F3E701
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

48484

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

dwmapi

DwmSetWindowAttribute

url_launcher_windows_plugin

UrlLauncherWindowsRegisterWithRegistrar

flutter_windows

FlutterDesktopViewControllerForceRedraw FlutterDesktopViewGetHWND FlutterDesktopResyncOutputStreams FlutterDesktopMessengerUnlock FlutterDesktopMessengerLock FlutterDesktopMessengerIsAvailable FlutterDesktopMessengerRelease FlutterDesktopMessengerAddRef FlutterDesktopMessengerSetCallback FlutterDesktopMessengerSendResponse FlutterDesktopMessengerSendWithReply FlutterDesktopMessengerSend FlutterDesktopViewControllerGetView FlutterDesktopViewControllerHandleTopLevelWindowProc FlutterDesktopViewControllerDestroy FlutterDesktopViewControllerCreate FlutterDesktopEngineSetNextFrameCallback FlutterDesktopEngineGetMessenger FlutterDesktopEngineGetPluginRegistrar FlutterDesktopEngineReloadSystemFonts FlutterDesktopEngineDestroy FlutterDesktopEngineCreate FlutterDesktopGetDpiForMonitor

kernel32

GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter IsProcessorFeaturePresent TerminateProcess GetCurrentProcess InitializeSListHead UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive SetUnhandledExceptionFilter LoadLibraryA GetProcAddress GetModuleHandleW FreeLibrary AllocConsole WideCharToMultiByte LocalFree GetCommandLineW GetStartupInfoW AttachConsole CreateMutexW GetLastError CloseHandle IsDebuggerPresent

user32

PostQuitMessage RegisterClassW UnregisterClassW CreateWindowExW DestroyWindow MoveWindow SetWindowPos SetFocus CreatePopupMenu DestroyMenu DefWindowProcW TrackPopupMenu GetClientRect GetCursorPos GetWindowLongPtrW SetWindowLongPtrW SetParent LoadCursorW LoadIconW MonitorFromPoint GetDpiForWindow SetForegroundWindow FindWindowW MessageBoxW AppendMenuW SendMessageW ShowWindow ReleaseCapture DispatchMessageW TranslateMessage GetMessageW

shell32

CommandLineToArgvW Shell_NotifyIconW

ole32

CoUninitialize CoInitializeEx

advapi32

RegGetValueW

msvcp140

?width@ios_base@std@@QEBA_JXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?_Raise_handler@std@@3P6AXAEBVexception@stdext@@@ZEA ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?sync_with_stdio@ios_base@std@@SA_N_N@Z ?width@ios_base@std@@QEAA_J_J@Z ?flags@ios_base@std@@QEBAHXZ ?good@ios_base@std@@QEBA_NXZ ?_Xbad_function_call@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ

vcruntime140

_CxxThrowException __std_exception_copy __current_exception_context __current_exception __C_specific_handler __std_type_info_compare memmove memset memcpy memcmp __std_terminate __std_exception_destroy

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function _initialize_onexit_table _c_exit terminate _crt_atexit exit _cexit _invoke_watson _initterm _get_wide_winmain_command_line _initialize_wide_environment _configure_wide_argv _initterm_e _set_app_type _seh_filter_exe _exit _register_thread_local_exe_atexit_callback

api-ms-win-crt-string-l1-1-0

wcslen wcscpy_s strlen

api-ms-win-crt-stdio-l1-1-0

freopen_s __acrt_iob_func _set_fmode _fileno _dup2 __p__commode

api-ms-win-crt-heap-l1-1-0

_callnewh free _set_new_mode malloc

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

HomeWayVPN\flutter_windows.dll

IMPHASH 43bdba0e433437185a2ca3ff043f1bea
SHA256 b66713715a7aeaa2f88ba18838aa7c245556eaaeb31c82da3f5aebcb71a7715e
MD5 225782e5d02f400a76b8fabe8a6f5cd1
SHA1 e54ef4f664a250808749be2ea9870607c20ace31
SHA512 9e88489361b36970a982329184b7afa9ef403ca86830427c60397e49522e5d38fc652ce4b65e79c54583a50ffee83fb138a02d638e015c9ff53e56164556be76
SSDEEP 98304:xk6EAbHbaq5XHYRpgzYv+tnesH+HjRZtUHTUz8xNCg2wByTjHfZ7FIpoUsxZ33eE:xxHjGgzG+sFGPBIfVmoRf3eIa
TLSH
T15F077C03F59540F9C08DD2B89B5BAA27F671B8490621B5DF278807263FA7BB05B3E750
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13679812

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\b\s\w\ir\cache\builder\src\out\ci\host_release\flutter_windows.dll.pdb

advapi32

RegOpenKeyExW RegCloseKey RegGetValueW RegNotifyChangeKeyValue RegQueryInfoKeyW RegEnumKeyExW RegDeleteValueW RegSetValueExW RegCreateKeyExW RegDeleteKeyW

iphlpapi

GetAdaptersAddresses

ole32

CoTaskMemFree CoTaskMemAlloc CoCreateInstance CoTaskMemRealloc

oleaut32

SysFreeString SysStringLen SafeArrayCreateVector SafeArrayPutElement VarBstrCmp LoadTypeLi SafeArrayGetLBound SafeArrayGetUBound SafeArrayGetVartype VarUI4FromStr VariantClear LoadRegTypeLi SafeArrayGetDim SafeArrayDestroy SafeArrayAccessData SafeArrayUnaccessData SysAllocString SysAllocStringLen VariantInit VariantCopy

psapi

GetProcessMemoryInfo EnumProcessModules

shlwapi

PathIsRelativeW PathCreateFromUrlW UrlIsW

rpcrt4

UuidCreateSequential RpcStringFreeW UuidToStringW

winmm

timeBeginPeriod timeEndPeriod

ws2_32

ioctlsocket freeaddrinfo socket getaddrinfo closesocket shutdown connect setsockopt recv send getsockopt WSAGetLastError WSASetLastError WSARecv WSASend WSASendTo WSARecvFrom GetHostNameW htons ntohs WSAAddressToStringW WSAStartup getsockname getpeername getnameinfo InetPtonW InetNtopW WSAIoctl WSASocketW listen bind

imm32

ImmGetCompositionStringW ImmReleaseContext ImmSetCompositionStringW ImmNotifyIME ImmGetContext ImmSetCandidateWindow ImmSetCompositionWindow

user32

GetSysColor SetClipboardData EmptyClipboard GetClipboardData IsClipboardFormatAvailable IsWindow CloseClipboard MessageBeep GetKeyState CloseTouchInputHandle GetTouchInputInfo DestroyCaret ReleaseCapture CreateCaret SetCapture GetMessageExtraInfo DefWindowProcW RegisterTouchWindow SetWindowLongPtrW SendMessageW MapVirtualKeyW PeekMessageW RegisterClassW PostMessageW TrackMouseEvent ScreenToClient GetCursorPos SetCursor DestroyWindow SetTimer SetUserObjectInformationA CreateWindowExW LoadCursorW SystemParametersInfoW ClientToScreen MonitorFromPoint MonitorFromWindow UnregisterClassW CreateIconIndirect ReleaseDC GetDC GetClassInfoW GetClientRect WindowFromDC GetWindowThreadProcessId IsIconic InvalidateRect CreateWindowExA KillTimer GetFocus SetCaretPos PostQuitMessage EnumThreadWindows GetParent CharNextW NotifyWinEvent GetWindowLongPtrW UnregisterClassA OpenClipboard

opengl32

wglGetProcAddress wglGetCurrentContext

bcrypt

BCryptGenRandom

api-ms-win-core-path-l1-1-0

PathCchCombineEx PathCchRemoveFileSpec

ntdll

RtlAddGrowableFunctionTable VerSetConditionMask RtlDeleteGrowableFunctionTable RtlUnwindEx RtlUnwind

oleacc

LresultFromObject

uiautomationcore

UiaRaiseAutomationEvent UiaRaiseAutomationPropertyChangedEvent UiaGetReservedNotSupportedValue UiaGetReservedMixedAttributeValue UiaHostProviderFromHwnd

propsys

VariantCompare

dxgi

CreateDXGIFactory1 CreateDXGIFactory

gdi32

GetPixelFormat SwapBuffers DescribePixelFormat SetPixelFormat ChoosePixelFormat SetDIBitsToDevice PatBlt GetDeviceCaps DeleteDC SetPixel GetPixel SelectObject CreateCompatibleBitmap GetObjectW CreateCompatibleDC CreateDIBSection DeleteObject

d3d9

D3DPERF_EndEvent D3DPERF_GetStatus Direct3DCreate9 D3DPERF_SetMarker D3DPERF_BeginEvent

kernel32

GetCommandLineA GetCPInfo CompareStringEx FlsFree FlsSetValue FlsAlloc LCMapStringEx InitializeCriticalSectionEx EncodePointer RtlPcToFileHeader GetStringTypeW InitOnceComplete InitOnceBeginInitialize GetExitCodeThread SwitchToThread GetFileInformationByHandleEx AreFileApisANSI FindFirstFileExW GetStartupInfoW IsProcessorFeaturePresent UnhandledExceptionFilter RtlVirtualUnwind GetProcessHeap GetOEMCP GetACP InterlockedPushEntrySList InterlockedFlushSList CreateThread ExitThread FlsGetValue FreeLibraryAndExitThread RtlLookupFunctionEntry RtlCaptureContext InitializeSListHead GetEnvironmentVariableW SetEnvironmentVariableW GetTempFileNameA GetTempPathA GetDriveTypeW GetFileAttributesExW LoadLibraryExA GetModuleHandleExA GetModuleHandleA LocaleNameToLCID lstrcmpiW SizeofResource LoadResource FindResourceW GetTimeZoneInformationForYear SleepConditionVariableSRW VirtualQuery TlsFree CreatePipe SetEvent Sleep QueryPerformanceCounter QueryPerformanceFrequency WakeAllConditionVariable WakeConditionVariable SleepConditionVariableCS InitializeConditionVariable TryAcquireSRWLockExclusive SetFileTime DeviceIoControl MoveFileW CopyFileExW CreateSymbolicLinkW GetFullPathNameW UnlockFileEx LockFileEx VirtualFree VirtualProtect SetFilePointerEx VirtualAlloc SetFileAttributesW MoveFileExW GetConsoleScreenBufferInfo GetExitCodeProcess CreateNamedPipeW TerminateProcess OpenProcess WaitForMultipleObjects CreateProcessW UpdateProcThreadAttribute InitializeProcThreadAttributeList DeleteProcThreadAttributeList ExitProcess FreeEnvironmentStringsW GetEnvironmentStringsW GetUserDefaultLocaleName GetSystemInfo SetUnhandledExceptionFilter SetCurrentDirectoryW GetCurrentDirectoryW GetQueuedCompletionStatus ReadDirectoryChangesW WriteFile PostQueuedCompletionStatus GetFileType OpenThread CancelIoEx CreateIoCompletionPort PeekNamedPipe HeapSize ReadConsoleW TzSpecificLocalTimeToSystemTime SystemTimeToFileTime HeapFree HeapAlloc GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapReAlloc GetModuleHandleExW IsValidCodePage SetStdHandle SetConsoleMode GetConsoleMode GetStdHandle SetConsoleCP SetConsoleOutputCP InitializeCriticalSectionAndSpinCount GetLastError FormatMessageW DecodePointer DeleteCriticalSection LoadLibraryA GetProcAddress CreateEventW RegisterWaitForSingleObject ResetEvent UnregisterWait CloseHandle OutputDebugStringW LocalFree GetCurrentProcess GetModuleHandleW GetCurrentThread SetThreadPriority GlobalAlloc GlobalFree GlobalLock GlobalUnlock GetLocaleInfoEx GetCurrentThreadId GetCurrentProcessId CreateToolhelp32Snapshot Thread32Next Thread32First FormatMessageA GetThreadPreferredUILanguages CreateSemaphoreW WaitForSingleObject ReleaseSemaphore WaitForSingleObjectEx RaiseException GetCommandLineW WideCharToMultiByte GetTempPathW CreateDirectoryW CreateFileW DuplicateHandle GetFileInformationByHandle GetFileAttributesW RemoveDirectoryW DeleteFileW SetFilePointer SetEndOfFile FlushViewOfFile FlushFileBuffers FindFirstFileW FindNextFileW FindClose GetFinalPathNameByHandleW GetFileSize CreateFileMappingW MapViewOfFile UnmapViewOfFile CreateWaitableTimerW VerifyVersionInfoW SetWaitableTimer LoadLibraryW FreeLibrary GetModuleFileNameW FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetTimeZoneInformation GetSystemTimeAsFileTime CreateFileA IsDebuggerPresent GetNativeSystemInfo LoadLibraryExW MultiByteToWideChar GetFileSizeEx ReadFile OutputDebugStringA InitOnceExecuteOnce InitializeSRWLock AcquireSRWLockShared AcquireSRWLockExclusive ReleaseSRWLockShared ReleaseSRWLockExclusive TlsGetValue TlsAlloc SetLastError TlsSetValue InitializeCriticalSection EnterCriticalSection LeaveCriticalSection GetFinalPathNameByHandleA SetConsoleCtrlHandler GetConsoleOutputCP WriteConsoleW

crypt32

CertCloseStore CertOpenStore CertEnumCertificatesInStore CertFreeCertificateContext

FlutterDesktopEngineCreate FlutterDesktopEngineCreateViewController FlutterDesktopEngineDestroy FlutterDesktopEngineGetMessenger FlutterDesktopEngineGetPluginRegistrar FlutterDesktopEngineGetTextureRegistrar FlutterDesktopEngineProcessExternalWindowMessage FlutterDesktopEngineProcessMessages FlutterDesktopEngineRegisterPlatformViewType FlutterDesktopEngineReloadSystemFonts FlutterDesktopEngineRun FlutterDesktopEngineSetNextFrameCallback FlutterDesktopGetDpiForHWND FlutterDesktopGetDpiForMonitor FlutterDesktopMessengerAddRef FlutterDesktopMessengerIsAvailable FlutterDesktopMessengerLock FlutterDesktopMessengerRelease FlutterDesktopMessengerSend FlutterDesktopMessengerSendResponse FlutterDesktopMessengerSendWithReply FlutterDesktopMessengerSetCallback FlutterDesktopMessengerUnlock FlutterDesktopPluginRegistrarGetMessenger FlutterDesktopPluginRegistrarGetView FlutterDesktopPluginRegistrarGetViewById FlutterDesktopPluginRegistrarRegisterTopLevelWindowProcDelegate FlutterDesktopPluginRegistrarSetDestructionHandler FlutterDesktopPluginRegistrarUnregisterTopLevelWindowProcDelegate FlutterDesktopRegistrarGetTextureRegistrar FlutterDesktopResyncOutputStreams FlutterDesktopTextureRegistrarMarkExternalTextureFrameAvailable FlutterDesktopTextureRegistrarRegisterExternalTexture FlutterDesktopTextureRegistrarUnregisterExternalTexture FlutterDesktopViewControllerCreate FlutterDesktopViewControllerDestroy FlutterDesktopViewControllerForceRedraw FlutterDesktopViewControllerGetEngine FlutterDesktopViewControllerGetView FlutterDesktopViewControllerGetViewId FlutterDesktopViewControllerHandleTopLevelWindowProc FlutterDesktopViewGetGraphicsAdapter FlutterDesktopViewGetHWND InternalFlutterGpuTestClass_Create InternalFlutterGpuTestClass_Method InternalFlutterGpuTestProc InternalFlutterGpuTestProcWithCallback InternalFlutterGpu_CommandBuffer_Initialize InternalFlutterGpu_CommandBuffer_Submit InternalFlutterGpu_Context_GetDefaultColorFormat InternalFlutterGpu_Context_GetDefaultDepthStencilFormat InternalFlutterGpu_Context_GetDefaultStencilFormat InternalFlutterGpu_Context_InitializeDefault InternalFlutterGpu_DeviceBuffer_Initialize InternalFlutterGpu_DeviceBuffer_InitializeWithHostData InternalFlutterGpu_DeviceBuffer_Overwrite InternalFlutterGpu_HostBuffer_EmplaceBytes InternalFlutterGpu_HostBuffer_Initialize InternalFlutterGpu_RenderPass_Begin InternalFlutterGpu_RenderPass_BindIndexBufferDevice InternalFlutterGpu_RenderPass_BindIndexBufferHost InternalFlutterGpu_RenderPass_BindPipeline InternalFlutterGpu_RenderPass_BindTexture InternalFlutterGpu_RenderPass_BindUniformDevice InternalFlutterGpu_RenderPass_BindUniformHost InternalFlutterGpu_RenderPass_BindVertexBufferDevice InternalFlutterGpu_RenderPass_BindVertexBufferHost InternalFlutterGpu_RenderPass_ClearBindings InternalFlutterGpu_RenderPass_Draw InternalFlutterGpu_RenderPass_Initialize InternalFlutterGpu_RenderPass_SetColorAttachment InternalFlutterGpu_RenderPass_SetColorBlendEnable InternalFlutterGpu_RenderPass_SetColorBlendEquation InternalFlutterGpu_RenderPass_SetDepthCompareOperation InternalFlutterGpu_RenderPass_SetDepthStencilAttachment InternalFlutterGpu_RenderPass_SetDepthWriteEnable InternalFlutterGpu_RenderPipeline_Initialize InternalFlutterGpu_ShaderLibrary_GetShader InternalFlutterGpu_ShaderLibrary_InitializeWithAsset InternalFlutterGpu_Shader_GetUniformMemberOffset InternalFlutterGpu_Shader_GetUniformStructSize InternalFlutterGpu_Texture_AsImage InternalFlutterGpu_Texture_BytesPerTexel InternalFlutterGpu_Texture_Initialize InternalFlutterGpu_Texture_Overwrite InternalFlutterGpu_Texture_SetCoordinateSystem

HomeWayVPN\mihomo.exe

IMPHASH 70df50797f7a85a271c38135c5679c40
SHA256 fba95e95fe15f289946d6227ead987fadc691906aaaafe325fe6fb2666c8a575
MD5 94131488108692fc8c8b8033253119d0
SHA1 e714de273dfa6fc971ce4934da6c434294cd181c
SHA512 d1ff5047291f376f732e7dd2c855771a4b25bbb9c0fc8fd200e68e34805aae3846e14eca23523381be77636f6e2255c27960b96c6c8386528787ffe12d93cae9
SSDEEP 196608:V+v+e9IkXc34XXQcTn/jWqSorbSKM3RapdBIaYntc8ClpSLjKZZcB:VMlZXK4XVeoSKppsa6t+lYL0yB
TLSH
T151B73B4BF9254CE4F5ADC538C9A652537B307C69872423E71B20FA146F3EBE05ABA350
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

590656

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

21.0MB

Virtual Size

21.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

23.5MB

Virtual Size

23.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1.4MB

Virtual Size

33.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

514KB

Virtual Size

513KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

192B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

482KB

Virtual Size

482KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

HomeWayVPN\url_launcher_windows_plugin.dll

IMPHASH 38966fb31f2087495afb89099286ae0b
SHA256 d6e9cc371d4ffc204b7134cf18d49d931b28f4fffb719baef27bcaf4a018dbd7
MD5 e817cf5d2f61f802a51af89bf337c9bf
SHA1 80ed348a2aedfa5ef66ae52c8250df8c7bce5e4b
SHA512 8b4885de095b3ddea183b489a8d73d38f510f4b8576cdd117c87cf48596f76f2a3b91bfff5c352de5d86d8759c4cc654df599b39143ea0a81d0e6b3c4852a86a
SSDEEP 1536:NGpZR9r942MfYxKj2866rzCoFB21it9LBwdIBB/7V4V1iGjigb:Nkfr942MQ86nxChBN7V4V1iGj
TLSH
T1E6A33A3BAB1D10ABD259D4BCCA534941DB72BC854791A7CF17A04ADB0F27BE44E3E602
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

53076

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

shlwapi

UrlUnescapeA

flutter_windows

FlutterDesktopTextureRegistrarUnregisterExternalTexture FlutterDesktopTextureRegistrarRegisterExternalTexture FlutterDesktopMessengerUnlock FlutterDesktopMessengerLock FlutterDesktopMessengerIsAvailable FlutterDesktopMessengerRelease FlutterDesktopTextureRegistrarMarkExternalTextureFrameAvailable FlutterDesktopMessengerSetCallback FlutterDesktopMessengerSendResponse FlutterDesktopMessengerSendWithReply FlutterDesktopMessengerSend FlutterDesktopRegistrarGetTextureRegistrar FlutterDesktopPluginRegistrarGetMessenger FlutterDesktopPluginRegistrarGetView FlutterDesktopPluginRegistrarSetDestructionHandler FlutterDesktopMessengerAddRef

kernel32

GetCurrentProcessId QueryPerformanceCounter TerminateProcess GetCurrentProcess IsProcessorFeaturePresent SetUnhandledExceptionFilter GetCurrentThreadId IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext SleepConditionVariableSRW WakeAllConditionVariable MultiByteToWideChar GetSystemTimeAsFileTime AcquireSRWLockExclusive ReleaseSRWLockExclusive DisableThreadLibraryCalls UnhandledExceptionFilter InitializeSListHead

shell32

ShellExecuteW

advapi32

RegCloseKey RegQueryValueExW RegOpenKeyExW

msvcp140

?_Xlength_error@std@@YAXPEBD@Z ?_Raise_handler@std@@3P6AXAEBVexception@stdext@@@ZEA ?_Xout_of_range@std@@YAXPEBD@Z ?uncaught_exception@std@@YA_NXZ ?good@ios_base@std@@QEBA_NXZ ?flags@ios_base@std@@QEBAHXZ ?width@ios_base@std@@QEBA_JXZ ?width@ios_base@std@@QEAA_J_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?_Xbad_function_call@std@@YAXXZ ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ

vcruntime140

_CxxThrowException memcpy memmove _purecall memcmp memset __std_type_info_compare __current_exception __current_exception_context __C_specific_handler __std_type_info_destroy_list __std_terminate __std_exception_destroy __std_exception_copy

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table _register_onexit_function _execute_onexit_table _configure_narrow_argv _cexit _initterm _initterm_e _seh_filter_dll terminate _invoke_watson _initialize_narrow_environment _crt_atexit

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-heap-l1-1-0

free malloc _callnewh

HomeWayVPN\watchdog.exe

IMPHASH fff2db20381aabf8491dcd4d84a7563c
SHA256 d916bf57e7aa12de524d6a33b4a8f6b0b6769826a730f30c139d76acb8a61541
MD5 4dccdf25447c396600e68c4d423d3929
SHA1 bcda83153b8a4946b0ac8fb1c08ea191df074743
SHA512 5c05071a403e4a7ca9d74f0ac019aeda3b5f77a298d01d77687cdb5960051b068f71c05820a640606551fb5b98ab1b08e8a208efb02728c658f44e2d5b7a42be
SSDEEP 384:YMkpfUM/bmYKqBDIHToVffoq6trSGtSLcV3w:sp8ebmhqSq16tnrV
TLSH
T1C4A22B47E7554AEDE07AD27CC962141AE2B6B51E0B22EBCF035002960F777D07D3AB86
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

12308

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

RegDeleteValueW RegOpenKeyExW RegQueryValueExW RegSetValueExW RegCloseKey

wininet

InternetSetOptionW

kernel32

GetStartupInfoW IsDebuggerPresent GetStdHandle GetCommandLineW WriteFile CloseHandle GetLastError WaitForSingleObject TerminateProcess GetExitCodeProcess CreateProcessW OpenProcess LocalFree WideCharToMultiByte CreateToolhelp32Snapshot Process32FirstW Process32NextW InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter IsProcessorFeaturePresent GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetModuleHandleW

shell32

CommandLineToArgvW

msvcp140

?_Xlength_error@std@@YAXPEBD@Z

vcruntime140

memcpy _CxxThrowException memmove __current_exception_context __std_exception_copy __current_exception __C_specific_handler wcsstr __std_exception_destroy memset

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table _seh_filter_exe _cexit _crt_atexit terminate _set_app_type _register_onexit_function _configure_wide_argv _exit _register_thread_local_exe_atexit_callback _invoke_watson exit _initterm_e _initterm _get_wide_winmain_command_line _initialize_wide_environment _c_exit

api-ms-win-crt-string-l1-1-0

_wcsicmp wcslen

api-ms-win-crt-stdio-l1-1-0

_set_fmode __stdio_common_vswprintf_s __p__commode

api-ms-win-crt-convert-l1-1-0

_wtoi

api-ms-win-crt-heap-l1-1-0

_callnewh free _set_new_mode malloc

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

HomeWayVPN.zip

HomeWayVPN\HomeWayVPN.exe

dwmapi

url_launcher_windows_plugin

flutter_windows

kernel32

user32

shell32

ole32

advapi32

msvcp140

vcruntime140

vcruntime140_1

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic

HomeWayVPN\data\app.so

HomeWayVPN\data\flutter_assets\AssetManifest.bin

HomeWayVPN\data\flutter_assets\AssetManifest.json

HomeWayVPN\data\flutter_assets\FontManifest.json

HomeWayVPN\data\flutter_assets\NOTICES.Z

NOTICES.Z

HomeWayVPN\data\flutter_assets\fonts\MaterialIcons-Regular.otf

HomeWayVPN\data\flutter_assets\shaders\ink_sparkle.frag

HomeWayVPN\data\icudtl.dat

HomeWayVPN\flutter_windows.dll

advapi32

iphlpapi

ole32

oleaut32

psapi

shlwapi

rpcrt4

winmm

ws2_32

imm32

user32

opengl32

bcrypt

api-ms-win-core-path-l1-1-0

ntdll

oleacc

uiautomationcore

propsys

dxgi

gdi32

d3d9

kernel32

crypt32

generic

HomeWayVPN\mihomo.exe

kernel32

generic

HomeWayVPN\url_launcher_windows_plugin.dll

shlwapi

flutter_windows

kernel32

shell32

advapi32

msvcp140

vcruntime140

vcruntime140_1

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic

HomeWayVPN\watchdog.exe

advapi32

wininet

kernel32

shell32