Overview

overview

10

Static

static

1

7a84c222d8...9N.exe

windows7-x64

10

7a84c222d8...9N.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    7a84c222d8df6ab173d6fa4fa6959ac93f8ae69041bd33a4fd40b7a7379c6de9N

  • Size

    7.0MB

  • Sample

    240930-yjt8tawepg

  • MD5

    17cfa850734b6c069309bb0a545e8300

  • SHA1

    40c034ef82a478279626bf77957ee944fb51781c

  • SHA256

    7a84c222d8df6ab173d6fa4fa6959ac93f8ae69041bd33a4fd40b7a7379c6de9

  • SHA512

    fee14ebea2c5e51c550c38763ce752b13da55c3e5607b1e45961609b9658e257faaa4ce9793bb00fe0987c08ff7e232e673e81963eae53c7e33e133bdd44129b

  • SSDEEP

    196608:2gWnoHTuvU99dm9E0Y5cDIfFRjZsekc0aEX12v:2gWMJdm9E0/DINNZNkfl2v

Score
10/10
floxifbackdoordiscoverypersistenceprivilege_escalationtrojanupx

Malware Config

Targets

    • Target

      7a84c222d8df6ab173d6fa4fa6959ac93f8ae69041bd33a4fd40b7a7379c6de9N

    • Size

      7.0MB

    • MD5

      17cfa850734b6c069309bb0a545e8300

    • SHA1

      40c034ef82a478279626bf77957ee944fb51781c

    • SHA256

      7a84c222d8df6ab173d6fa4fa6959ac93f8ae69041bd33a4fd40b7a7379c6de9

    • SHA512

      fee14ebea2c5e51c550c38763ce752b13da55c3e5607b1e45961609b9658e257faaa4ce9793bb00fe0987c08ff7e232e673e81963eae53c7e33e133bdd44129b

    • SSDEEP

      196608:2gWnoHTuvU99dm9E0Y5cDIfFRjZsekc0aEX12v:2gWMJdm9E0/DINNZNkfl2v

    Score
    10/10
    floxifbackdoordiscoverypersistenceprivilege_escalationtrojanupx

    • Floxif, Floodfix

      Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.

      backdoortrojanfloxif

    • Detects Floxif payload

      backdoor

    • Event Triggered Execution: AppInit DLLs

      Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

      persistenceprivilege_escalation

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Executes dropped EXE

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks