floxif | 5bb4b8c4dd1960eb09e903347449cc364513ce416a217db2ab9ecb504d4656c0

General

Target
307414151e44eed576edbaced6795160N.exe
Size 136KB
Sample240820-ej5j1asekh
SHA256 5bb4b8c4dd1960eb09e903347449cc364513ce416a217db2ab9ecb504d4656c0
MD5 307414151e44eed576edbaced6795160
SHA1 9143284d901ddef0de136f36d3347c0d3aedcb08
SHA512 4c1be5417c980ccd9ec425945f3c9054c6efcb0d4c1b256647ab0ef410c5b1e60797554668bee77b8b3b27dd26791f8ceeae38379e4847eaf56256d69f3b8c5f
SSDEEP 3072:Itmr/eq8Ktvx1I2lQBV+UdE+rECWp7hKXpX:Icl8KcBV+UdvrEFp7hKXpX
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  307414151e44eed576edbaced6795160N.exe
- Size 136KB
- SHA256 5bb4b8c4dd1960eb09e903347449cc364513ce416a217db2ab9ecb504d4656c0
- MD5 307414151e44eed576edbaced6795160
- SHA1 9143284d901ddef0de136f36d3347c0d3aedcb08
- SHA512 4c1be5417c980ccd9ec425945f3c9054c6efcb0d4c1b256647ab0ef410c5b1e60797554668bee77b8b3b27dd26791f8ceeae38379e4847eaf56256d69f3b8c5f
- SSDEEP 3072:Itmr/eq8Ktvx1I2lQBV+UdE+rECWp7hKXpX:Icl8KcBV+UdvrEFp7hKXpX
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

floxif backdoor discovery evasion persistence privilege_escalation spyware stealer trojan upx
- Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Modifies firewall policy service
  evasion
- Detects Floxif payload
  backdoor
- Drops file in Drivers directory
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Suspicious use of SetThreadContext
behavioral1 behavioral2