General

  • Target

    2024-09-26_8a30387f66a5a44c63bab13b1b4cc740_floxif_icedid

  • Size

    2.5MB

  • Sample

    240926-fkbhzs1gra

  • MD5

    8a30387f66a5a44c63bab13b1b4cc740

  • SHA1

    4a7d415252d6bdec6dfda5af46e4e0ac391adfdf

  • SHA256

    5882158ffb894d171e48a960ba9d840415e0b685d41b397323d3520e76d224c7

  • SHA512

    195d500137a3a664e175bc9c35f247a8d70f4f7f841eadd48fb243575ac6a96b2fbeac29e872505d2048db3179ae24174af5ba85b0b03610385ecf5b9e636141

  • SSDEEP

    24576:J1r+vN1Km2ZVjvCey6bghfr2dOI/HQHqjqTgzXTo1poWYWX423IQQKCz81aWxADX:IN7w7p6r2dOI/HeqIAT+RVIDKCzYaqw

Malware Config

Targets

    • Target

      2024-09-26_8a30387f66a5a44c63bab13b1b4cc740_floxif_icedid

    • Size

      2.5MB

    • MD5

      8a30387f66a5a44c63bab13b1b4cc740

    • SHA1

      4a7d415252d6bdec6dfda5af46e4e0ac391adfdf

    • SHA256

      5882158ffb894d171e48a960ba9d840415e0b685d41b397323d3520e76d224c7

    • SHA512

      195d500137a3a664e175bc9c35f247a8d70f4f7f841eadd48fb243575ac6a96b2fbeac29e872505d2048db3179ae24174af5ba85b0b03610385ecf5b9e636141

    • SSDEEP

      24576:J1r+vN1Km2ZVjvCey6bghfr2dOI/HQHqjqTgzXTo1poWYWX423IQQKCz81aWxADX:IN7w7p6r2dOI/HeqIAT+RVIDKCzYaqw

    • Floxif, Floodfix

      Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.

    • Detects Floxif payload

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks