General

  • Target

    2024-08-16_d152d35480e26626694c6e6c82ed5515_floxif_mafia

  • Size

    1.4MB

  • Sample

    240816-e1pvwavepc

  • MD5

    d152d35480e26626694c6e6c82ed5515

  • SHA1

    9bb593bab55a9b75d5230054ba3bc4b599b5a790

  • SHA256

    65501cccba7dfd2a5e3be40c7bd945f4b0754b0c9f3466f58d42f8439426283a

  • SHA512

    e27d5537213d4ee3597ef9ef8f7e726c0ebff6de3878274852b224fc2fd04676d41ee1ccd7a99029ca366f36ea2dea724db4fb00f21dbb596d25530cbe22c564

  • SSDEEP

    24576:SKAd/monVAqRVzkBhtB6sUR/GJ8Tr5wWjsrwrPsrf8NRbAraf2vzOrEH7o:ZsnVAqR8B6sO+6T1wWjskbswNRkUez6

Malware Config

Targets

    • Target

      2024-08-16_d152d35480e26626694c6e6c82ed5515_floxif_mafia

    • Size

      1.4MB

    • MD5

      d152d35480e26626694c6e6c82ed5515

    • SHA1

      9bb593bab55a9b75d5230054ba3bc4b599b5a790

    • SHA256

      65501cccba7dfd2a5e3be40c7bd945f4b0754b0c9f3466f58d42f8439426283a

    • SHA512

      e27d5537213d4ee3597ef9ef8f7e726c0ebff6de3878274852b224fc2fd04676d41ee1ccd7a99029ca366f36ea2dea724db4fb00f21dbb596d25530cbe22c564

    • SSDEEP

      24576:SKAd/monVAqRVzkBhtB6sUR/GJ8Tr5wWjsrwrPsrf8NRbAraf2vzOrEH7o:ZsnVAqR8B6sO+6T1wWjskbswNRkUez6

    • Floxif, Floodfix

      Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.

    • Detects Floxif payload

    • Event Triggered Execution: AppInit DLLs

      Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks