Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    2024-08-10_b186a97ff3d63c4f7a25c7283ae9ca65_floxif_hijackloader_mafia

  • Size

    2.7MB

  • Sample

    240810-rwhl8axerh

  • MD5

    b186a97ff3d63c4f7a25c7283ae9ca65

  • SHA1

    fc9ee0fdb66393f48c6c1ec1486dc2cf68d6256c

  • SHA256

    9fc4e1ba9f8919469613c67c1b1f475f8794c70840f1d0a12fe486388ddce72c

  • SHA512

    c622c6fb0c89d6c15f659f8e0cbbf9ec03abde6e88aee38644142cb6d6e4d7a9de18d844d2768a5501e0952cc442cc09eef22726f875a38fe608657e3f9a47f8

  • SSDEEP

    49152:Flks4A6lVLD6Sc60FNUFFIIsTp69FlNN7boUvH6u//zHDwhXPwMQ9i9ZMW/KMZKN:/n6n6+0FUFIIsTY9Fl/7boUi+HwZPwMG

Malware Config

Targets

    • Target

      2024-08-10_b186a97ff3d63c4f7a25c7283ae9ca65_floxif_hijackloader_mafia

    • Size

      2.7MB

    • MD5

      b186a97ff3d63c4f7a25c7283ae9ca65

    • SHA1

      fc9ee0fdb66393f48c6c1ec1486dc2cf68d6256c

    • SHA256

      9fc4e1ba9f8919469613c67c1b1f475f8794c70840f1d0a12fe486388ddce72c

    • SHA512

      c622c6fb0c89d6c15f659f8e0cbbf9ec03abde6e88aee38644142cb6d6e4d7a9de18d844d2768a5501e0952cc442cc09eef22726f875a38fe608657e3f9a47f8

    • SSDEEP

      49152:Flks4A6lVLD6Sc60FNUFFIIsTp69FlNN7boUvH6u//zHDwhXPwMQ9i9ZMW/KMZKN:/n6n6+0FUFIIsTY9Fl/7boUi+HwZPwMG

    • Floxif, Floodfix

      Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.

    • Detects Floxif payload

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.