General

  • Target

    2024-09-13_2d3ac478475282f6c1bcb4e8f6919b61_floxif_hijackloader_mafia

  • Size

    2.7MB

  • Sample

    240913-pzmn8ssajb

  • MD5

    2d3ac478475282f6c1bcb4e8f6919b61

  • SHA1

    243cd5193cd0d18a1c3762407a584eda4ac62526

  • SHA256

    78a5acc86c7e6c719aab2a754d6cef97e8c758aac2c9ef0e0ca9a7d4cb69a77b

  • SHA512

    0b5fc149eafede51f6a29190f0486878499c2433ae10aea3f973d66c37c1c7e53eef299e7f5c8503c6a057aee91c63fe8b13e8f0d9fb0d0b48c4a6ef0c0e0326

  • SSDEEP

    49152:uaSofyDdWWqJXBhgmvQojZ2toFPVmyN8LrOR23P2yYI1a7B5lcdtH9jR9W/KMZKW:nudEBhzQoMtoFPVmyN8LrOR23O8M77l7

Malware Config

Targets

    • Target

      2024-09-13_2d3ac478475282f6c1bcb4e8f6919b61_floxif_hijackloader_mafia

    • Size

      2.7MB

    • MD5

      2d3ac478475282f6c1bcb4e8f6919b61

    • SHA1

      243cd5193cd0d18a1c3762407a584eda4ac62526

    • SHA256

      78a5acc86c7e6c719aab2a754d6cef97e8c758aac2c9ef0e0ca9a7d4cb69a77b

    • SHA512

      0b5fc149eafede51f6a29190f0486878499c2433ae10aea3f973d66c37c1c7e53eef299e7f5c8503c6a057aee91c63fe8b13e8f0d9fb0d0b48c4a6ef0c0e0326

    • SSDEEP

      49152:uaSofyDdWWqJXBhgmvQojZ2toFPVmyN8LrOR23P2yYI1a7B5lcdtH9jR9W/KMZKW:nudEBhzQoMtoFPVmyN8LrOR23O8M77l7

    • Floxif, Floodfix

      Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.

    • Detects Floxif payload

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks