General

  • Target

    98e1112acfadfeb2686b13e9feebe53ccc52e95e34c367c5b12c7680c2a9d5cb

  • Size

    1.4MB

  • Sample

    240808-mexycswcne

  • MD5

    5fb205c1cf9bf14794ff786817c5f67e

  • SHA1

    140183434a95419c6f1f3e077dd3c02247ad7446

  • SHA256

    98e1112acfadfeb2686b13e9feebe53ccc52e95e34c367c5b12c7680c2a9d5cb

  • SHA512

    ac759ee052ab34b84e0b218adea908e529e2adc6945dda0055b7c5259bd56a0bd8a1abc58f3368d25957f96a0e99876b840197fc3ffdd85ceda79dfdaf307f2f

  • SSDEEP

    24576:g38Kn/B1FBgDXZNFfZoWe0KVIC9ClKa5IrykTHhQ5NoRyftZZriXWzr6pfKuIVrF:xKZ1rgXteP3Vz9oI2mhoNosVDP+fX2

Malware Config

Targets

    • Target

      98e1112acfadfeb2686b13e9feebe53ccc52e95e34c367c5b12c7680c2a9d5cb

    • Size

      1.4MB

    • MD5

      5fb205c1cf9bf14794ff786817c5f67e

    • SHA1

      140183434a95419c6f1f3e077dd3c02247ad7446

    • SHA256

      98e1112acfadfeb2686b13e9feebe53ccc52e95e34c367c5b12c7680c2a9d5cb

    • SHA512

      ac759ee052ab34b84e0b218adea908e529e2adc6945dda0055b7c5259bd56a0bd8a1abc58f3368d25957f96a0e99876b840197fc3ffdd85ceda79dfdaf307f2f

    • SSDEEP

      24576:g38Kn/B1FBgDXZNFfZoWe0KVIC9ClKa5IrykTHhQ5NoRyftZZriXWzr6pfKuIVrF:xKZ1rgXteP3Vz9oI2mhoNosVDP+fX2

    • Floxif, Floodfix

      Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.

    • Detects Floxif payload

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Enterprise v15

Tasks