General

  • Target

    2024-07-05_10325066044afe936eab8b57dfb89de6_floxif_magniber

  • Size

    1.9MB

  • Sample

    240705-1qy7fswhmj

  • MD5

    10325066044afe936eab8b57dfb89de6

  • SHA1

    3dc85180489ef6332766736b9bca3ae3c2a69ccc

  • SHA256

    4b25a4ba72f7d8905786187d35e56a5490c9e9d706ddc01dc1daf20726855d31

  • SHA512

    3528ac1d32b1887943e8dfed114c3d47ec8724f13c2e9cf7168b534c216a9b5dae2f4f2a7c14601e7185ceed3c5673ff7b60bdb5e503501239cf5271b1330d63

  • SSDEEP

    24576:wpa5d0ZJVXUnvQs4Tcfab47xXeVn4A3TgMMsRsIn9eDR/E6jrEH7j:gdls4TiaU7xXm7TgMM4IEn

Malware Config

Targets

    • Target

      2024-07-05_10325066044afe936eab8b57dfb89de6_floxif_magniber

    • Size

      1.9MB

    • MD5

      10325066044afe936eab8b57dfb89de6

    • SHA1

      3dc85180489ef6332766736b9bca3ae3c2a69ccc

    • SHA256

      4b25a4ba72f7d8905786187d35e56a5490c9e9d706ddc01dc1daf20726855d31

    • SHA512

      3528ac1d32b1887943e8dfed114c3d47ec8724f13c2e9cf7168b534c216a9b5dae2f4f2a7c14601e7185ceed3c5673ff7b60bdb5e503501239cf5271b1330d63

    • SSDEEP

      24576:wpa5d0ZJVXUnvQs4Tcfab47xXeVn4A3TgMMsRsIn9eDR/E6jrEH7j:gdls4TiaU7xXm7TgMM4IEn

    • Floxif, Floodfix

      Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.

    • Detects Floxif payload

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Enterprise v15

Tasks