floxif | 34cb289cf029b8a64e0e8496028beca0d5fc2512ae6a819b9cc81becad7153c4 | Triage

Submit
Reports

Overview

overview

Static

static

1

34cb289cf0...c4.dll

windows7-x64

34cb289cf0...c4.dll

windows10-2004-x64

Sharing

General

Target

34cb289cf029b8a64e0e8496028beca0d5fc2512ae6a819b9cc81becad7153c4
Size

503KB
Sample

240902-y7rslawenq
MD5

e7fc585d8b99d241a2b609743f3eb28c
SHA1

8d07cf4f82f1c606aef638dd389f6b3f4c0af78f
SHA256

34cb289cf029b8a64e0e8496028beca0d5fc2512ae6a819b9cc81becad7153c4
SHA512

9a130e233f94cf2b5647bdad4e01f8e9cab69a2722511fbe13cd7ca41549b840e3ec9cf490796d992f8f9361f3328abb8a8996df56bdfb1dcaa764ff84fc38be
SSDEEP

12288:uSCeuqF7Ev7bKez4X4ArBaA5q9vonshRqermBzTBjvrEH7y:hC5U7Ev7b7AdaAConshRABzJrEH7y

Score

10^/10

floxif backdoor discovery persistence privilege_escalation trojan upx

Static task

static1

Behavioral task

behavioral1

Sample

34cb289cf029b8a64e0e8496028beca0d5fc2512ae6a819b9cc81becad7153c4.dll

Resource

win7-20240704-en

floxif backdoor discovery trojan upx

windows7-x64

10 signatures

150 seconds

Behavioral task

behavioral2

Sample

34cb289cf029b8a64e0e8496028beca0d5fc2512ae6a819b9cc81becad7153c4.dll

Resource

win10v2004-20240802-en

floxif backdoor discovery persistence privilege_escalation trojan upx

windows10-2004-x64

11 signatures

150 seconds

Malware Config

Targets

- Target
  
  34cb289cf029b8a64e0e8496028beca0d5fc2512ae6a819b9cc81becad7153c4
- Size
  
  503KB
- MD5
  
  e7fc585d8b99d241a2b609743f3eb28c
- SHA1
  
  8d07cf4f82f1c606aef638dd389f6b3f4c0af78f
- SHA256
  
  34cb289cf029b8a64e0e8496028beca0d5fc2512ae6a819b9cc81becad7153c4
- SHA512
  
  9a130e233f94cf2b5647bdad4e01f8e9cab69a2722511fbe13cd7ca41549b840e3ec9cf490796d992f8f9361f3328abb8a8996df56bdfb1dcaa764ff84fc38be
- SSDEEP
  
  12288:uSCeuqF7Ev7bKez4X4ArBaA5q9vonshRqermBzTBjvrEH7y:hC5U7Ev7b7AdaAConshRABzJrEH7y
Score

10^/10

floxif backdoor discovery trojan upx persistence privilege_escalation
- Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Detects Floxif payload
  backdoor
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

AppInit DLLs

Privilege Escalation

Event Triggered Execution

AppInit DLLs

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

floxifbackdoordiscoverytrojanupx

behavioral2

floxifbackdoordiscoverypersistenceprivilege_escalationtrojanupx

© 2018-2025

Terms | Privacy