Overview

overview

10

Static

static

7

28e03cb3d1...0N.exe

windows7-x64

10

28e03cb3d1...0N.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    28e03cb3d15032e6d292246d3d8fbf20N.exe

  • Size

    209KB

  • Sample

    240709-eg2qbsxdjc

  • MD5

    28e03cb3d15032e6d292246d3d8fbf20

  • SHA1

    7b31fd40bfd8f7d889dad2c9c894d2a785919b8c

  • SHA256

    f22e514699908461857b4d80977b56af783c3eeae97dfe7ed6ecf38e255f9fa2

  • SHA512

    189bce611c9f23859f9de444096fec7df87d34fdfebc86ae7253f6e1350de24326a8cd4c6393e34f0ba89b6b16f5b45df428ae7194850b05bcbc9e08984517d4

  • SSDEEP

    3072:CZx8gJsculEa+J2outueXlCJQ33f8PfJA+R4NvVwFmrtBj3:w2AsnlEanoSZnU3JAEwVwUrT7

Score
10/10
floxifbackdoorevasionpersistencetrojanupx

Malware Config

Targets

    • Target

      28e03cb3d15032e6d292246d3d8fbf20N.exe

    • Size

      209KB

    • MD5

      28e03cb3d15032e6d292246d3d8fbf20

    • SHA1

      7b31fd40bfd8f7d889dad2c9c894d2a785919b8c

    • SHA256

      f22e514699908461857b4d80977b56af783c3eeae97dfe7ed6ecf38e255f9fa2

    • SHA512

      189bce611c9f23859f9de444096fec7df87d34fdfebc86ae7253f6e1350de24326a8cd4c6393e34f0ba89b6b16f5b45df428ae7194850b05bcbc9e08984517d4

    • SSDEEP

      3072:CZx8gJsculEa+J2outueXlCJQ33f8PfJA+R4NvVwFmrtBj3:w2AsnlEanoSZnU3JAEwVwUrT7

    Score
    10/10
    floxifbackdoorevasionpersistencetrojanupx

    • Floxif, Floodfix

      Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.

      backdoortrojanfloxif

    • UAC bypass

      evasiontrojan

    • Windows security bypass

      evasiontrojan

    • Detects Floxif payload

      backdoor

    • Drops file in Drivers directory

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks