banload

General

Target

2024-07-31_bdc9ccfd02299a912f601544b3ee8a3a_floxif_magniber
Size

5.2MB
Sample

240731-qpj12azdrf
MD5

bdc9ccfd02299a912f601544b3ee8a3a
SHA1

21b35ec7699684e30eedab35f5d35377df3588c6
SHA256

ee80f200d5d6b03469af91238f8e14321bbd6f302dc950f83da2154dbd07eb56
SHA512

8df2d65b913c84d527c9a453d94cb2bf2a431fece2ca86642ec0627544dba310ab02c9d7da354bf823fe73233f9f18c5db8c6abc852b3a84b0f98a2c35501e00
SSDEEP

98304:QbiYtOFMxvGGGfwhpX8WGEOkIpTIvnN73a9cchKNWnchtlYGtLsbr257iMKN:QbiYtOFMxvGGGfw7MWG8NnNrgheWn8WF

Score

10^/10

Malware Config

Targets

- Target
  
  2024-07-31_bdc9ccfd02299a912f601544b3ee8a3a_floxif_magniber
- Size
  
  5.2MB
- MD5
  
  bdc9ccfd02299a912f601544b3ee8a3a
- SHA1
  
  21b35ec7699684e30eedab35f5d35377df3588c6
- SHA256
  
  ee80f200d5d6b03469af91238f8e14321bbd6f302dc950f83da2154dbd07eb56
- SHA512
  
  8df2d65b913c84d527c9a453d94cb2bf2a431fece2ca86642ec0627544dba310ab02c9d7da354bf823fe73233f9f18c5db8c6abc852b3a84b0f98a2c35501e00
- SSDEEP
  
  98304:QbiYtOFMxvGGGfwhpX8WGEOkIpTIvnN73a9cchKNWnchtlYGtLsbr257iMKN:QbiYtOFMxvGGGfw7MWG8NnNrgheWn8WF
Score

10^/10

banload floxif backdoor discovery downloader dropper evasion trojan upx persistence privilege_escalation
- Banload
  Banload variants download malicious files, then install and execute the files.
  trojan dropper downloader banload
- Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Detects Floxif payload
  backdoor
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2