floxif | b1ddbadf76df0b98d3832c2a5a3b91a1dfe71a27dd5a2012094870b7f1fea81a

General

Target
b1ddbadf76df0b98d3832c2a5a3b91a1dfe71a27dd5a2012094870b7f1fea81a
Size 114KB
Sample240828-c7vctstdnl
SHA256 b1ddbadf76df0b98d3832c2a5a3b91a1dfe71a27dd5a2012094870b7f1fea81a
MD5 0a0ed709ac8ff4b2efa718a0a7f89ae0
SHA1 506fb4073d9b0c2f7c07a4ba7cddda7000bd6784
SHA512 cdc4164d109bd72e4efa1f49d5fe30081ba76185ae3ebb3c13e2032c0503a9e9ea535ac99176eb02e626de4ef19b14ec735cd8bcdb5b4fcfe8591ea73ad4e088
SSDEEP 3072:aOXpHkXxout/R8V3D2lQBV+UdE+rECWp7hKAh:rpkXxoS/IHBV+UdvrEFp7hKAh
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  b1ddbadf76df0b98d3832c2a5a3b91a1dfe71a27dd5a2012094870b7f1fea81a
- Size 114KB
- SHA256 b1ddbadf76df0b98d3832c2a5a3b91a1dfe71a27dd5a2012094870b7f1fea81a
- MD5 0a0ed709ac8ff4b2efa718a0a7f89ae0
- SHA1 506fb4073d9b0c2f7c07a4ba7cddda7000bd6784
- SHA512 cdc4164d109bd72e4efa1f49d5fe30081ba76185ae3ebb3c13e2032c0503a9e9ea535ac99176eb02e626de4ef19b14ec735cd8bcdb5b4fcfe8591ea73ad4e088
- SSDEEP 3072:aOXpHkXxout/R8V3D2lQBV+UdE+rECWp7hKAh:rpkXxoS/IHBV+UdvrEFp7hKAh
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

floxif backdoor discovery trojan upx
- Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Detects Floxif payload
  backdoor
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Floxif, Floodfix

Detects Floxif payload

ACProtect 1.3x - 1.4x DLL software

Checks computer location settings

Loads dropped DLL

UPX packed file

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2