floxif | 9fc4e1ba9f8919469613c67c1b1f475f8794c70840f1d0a12fe486388ddce72c | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

1

2024-08-10...ia.exe

windows7-x64

2024-08-10...ia.exe

windows10-2004-x64

Sharing

General

Target

2024-08-10_b186a97ff3d63c4f7a25c7283ae9ca65_floxif_hijackloader_mafia
Size

2.7MB
Sample

240810-rwhl8axerh
MD5

b186a97ff3d63c4f7a25c7283ae9ca65
SHA1

fc9ee0fdb66393f48c6c1ec1486dc2cf68d6256c
SHA256

9fc4e1ba9f8919469613c67c1b1f475f8794c70840f1d0a12fe486388ddce72c
SHA512

c622c6fb0c89d6c15f659f8e0cbbf9ec03abde6e88aee38644142cb6d6e4d7a9de18d844d2768a5501e0952cc442cc09eef22726f875a38fe608657e3f9a47f8
SSDEEP

49152:Flks4A6lVLD6Sc60FNUFFIIsTp69FlNN7boUvH6u//zHDwhXPwMQ9i9ZMW/KMZKN:/n6n6+0FUFIIsTY9Fl/7boUi+HwZPwMG

Score

10^/10

floxif backdoor discovery trojan upx

Static task

static1

Behavioral task

behavioral1

Sample

2024-08-10_b186a97ff3d63c4f7a25c7283ae9ca65_floxif_hijackloader_mafia.exe

Resource

win7-20240704-en

floxif backdoor discovery trojan upx

windows7-x64

9 signatures

150 seconds

Behavioral task

behavioral2

Sample

2024-08-10_b186a97ff3d63c4f7a25c7283ae9ca65_floxif_hijackloader_mafia.exe

Resource

win10v2004-20240802-en

floxif backdoor discovery trojan upx

windows10-2004-x64

12 signatures

150 seconds

Malware Config

Targets

- Target
  
  2024-08-10_b186a97ff3d63c4f7a25c7283ae9ca65_floxif_hijackloader_mafia
- Size
  
  2.7MB
- MD5
  
  b186a97ff3d63c4f7a25c7283ae9ca65
- SHA1
  
  fc9ee0fdb66393f48c6c1ec1486dc2cf68d6256c
- SHA256
  
  9fc4e1ba9f8919469613c67c1b1f475f8794c70840f1d0a12fe486388ddce72c
- SHA512
  
  c622c6fb0c89d6c15f659f8e0cbbf9ec03abde6e88aee38644142cb6d6e4d7a9de18d844d2768a5501e0952cc442cc09eef22726f875a38fe608657e3f9a47f8
- SSDEEP
  
  49152:Flks4A6lVLD6Sc60FNUFFIIsTp69FlNN7boUvH6u//zHDwhXPwMQ9i9ZMW/KMZKN:/n6n6+0FUFIIsTY9Fl/7boUi+HwZPwMG
Score

10^/10

floxif backdoor discovery trojan upx
- Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Detects Floxif payload
  backdoor
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

floxifbackdoordiscoverytrojanupx

behavioral2

floxifbackdoordiscoverytrojanupx

© 2018-2025

Terms | Privacy

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.