General
-
Target
2024-09-05_aef2bfae94193a904297ac137d9988a5_avoslocker_bitrat_floxif_hijackloader
-
Size
2.7MB
-
Sample
240905-pryfrs1hja
-
MD5
aef2bfae94193a904297ac137d9988a5
-
SHA1
668594b00a333fca4002f716311cd5aa4201d99f
-
SHA256
379a076f2f1971290d9585f2847c14db67cfcee82b8a318b9b7516ecc5f295f4
-
SHA512
f740415c48cf003aef77852c3aeed485bbbfb15a37f65d0037529eab03a15c727333af4f7a4e4b8ea06781cbcb5fb4a62c6531a00772ceba9bcec4a65f28dfbd
-
SSDEEP
49152:VTD7Jvx66J9507uEiVw6kT+cT+0FVA7ri/7xznSqur7bT9iAvIyD94OeDD7lrZ+E:VrJ/9505S0pVLtFAZwuLcmhWibDA
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-05_aef2bfae94193a904297ac137d9988a5_avoslocker_bitrat_floxif_hijackloader.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-09-05_aef2bfae94193a904297ac137d9988a5_avoslocker_bitrat_floxif_hijackloader.exe
Resource
win10v2004-20240802-en
Malware Config
Targets
-
-
Target
2024-09-05_aef2bfae94193a904297ac137d9988a5_avoslocker_bitrat_floxif_hijackloader
-
Size
2.7MB
-
MD5
aef2bfae94193a904297ac137d9988a5
-
SHA1
668594b00a333fca4002f716311cd5aa4201d99f
-
SHA256
379a076f2f1971290d9585f2847c14db67cfcee82b8a318b9b7516ecc5f295f4
-
SHA512
f740415c48cf003aef77852c3aeed485bbbfb15a37f65d0037529eab03a15c727333af4f7a4e4b8ea06781cbcb5fb4a62c6531a00772ceba9bcec4a65f28dfbd
-
SSDEEP
49152:VTD7Jvx66J9507uEiVw6kT+cT+0FVA7ri/7xznSqur7bT9iAvIyD94OeDD7lrZ+E:VrJ/9505S0pVLtFAZwuLcmhWibDA
-
Detects Floxif payload
-
Event Triggered Execution: AppInit DLLs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-