Overview

overview

10

Static

static

1

2024-08-22...er.exe

windows7-x64

10

2024-08-22...er.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2024-08-22_695cf0e0e64b17b5ffea0ca22b96cae6_floxif_magniber

  • Size

    13.0MB

  • Sample

    240822-axm5nasgnr

  • MD5

    695cf0e0e64b17b5ffea0ca22b96cae6

  • SHA1

    d2bf378c63c629b578e812ecb5540f65074c29ca

  • SHA256

    9581deeb070f51498358ac575bd6ec57843dc31bc0d4b4be222866cd4a08ddef

  • SHA512

    745a271fc2ed962a32efee53545d5ad5f4cae19b1c653f1d651e8fb61cdab7de8663b1b9bdbe6333b8e780400a84c7fc60f1d5e442531e677adefb3a2655e013

  • SSDEEP

    196608:zB9nXin0GMbtHPQ6YHhATlZKvofOnn2ypPKibY3Qp66viN9ZQmV:zB9na0vbtHLEhATlZKwUn2kKZBl

Score
10/10
banloadfloxifbackdoordiscoverydownloaderdropperevasiontrojanupx

Malware Config

Targets

    • Target

      2024-08-22_695cf0e0e64b17b5ffea0ca22b96cae6_floxif_magniber

    • Size

      13.0MB

    • MD5

      695cf0e0e64b17b5ffea0ca22b96cae6

    • SHA1

      d2bf378c63c629b578e812ecb5540f65074c29ca

    • SHA256

      9581deeb070f51498358ac575bd6ec57843dc31bc0d4b4be222866cd4a08ddef

    • SHA512

      745a271fc2ed962a32efee53545d5ad5f4cae19b1c653f1d651e8fb61cdab7de8663b1b9bdbe6333b8e780400a84c7fc60f1d5e442531e677adefb3a2655e013

    • SSDEEP

      196608:zB9nXin0GMbtHPQ6YHhATlZKvofOnn2ypPKibY3Qp66viN9ZQmV:zB9na0vbtHLEhATlZKwUn2kKZBl

    Score
    10/10
    banloadfloxifbackdoordiscoverydownloaderdropperevasiontrojanupx

    • Banload

      Banload variants download malicious files, then install and execute the files.

      trojandropperdownloaderbanload

    • Floxif, Floodfix

      Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.

      backdoortrojanfloxif

    • Detects Floxif payload

      backdoor

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks