Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
17/10/2024, 12:36
General
-
Target
2024-10-17_81b0ffbb11e8b6a32316bc76ade1e6c8_floxif_mafia.exe
-
Size
1.9MB
-
MD5
81b0ffbb11e8b6a32316bc76ade1e6c8
-
SHA1
3c8d29a5ca8d2e26cd01062317d6d6470d82c9c2
-
SHA256
d2ea98325c941c4052a485c7d078a2c4a46b33f1f3815b59339c6a3b0f5f7b17
-
SHA512
b820366f2f4039d77d8b6c38c3957406c73ac57e55e5cdb5a72b024c6958ba38a573ee70b176dd0f8579203192a4c94c6bc9bf6417393d7860391ff3e2d5d718
-
SSDEEP
49152:WWpQTW3vYptbUE0QI662K8E11Jkc/ookTD79C6A4tVxckwD9:6ptbUE0Qw2K51Jkc/ooYk45xm
Malware Config
Signatures
-
Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
-
Detects Floxif payload 1 IoCs
-
Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
-
Loads dropped DLL 2 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Program Files directory 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-17_81b0ffbb11e8b6a32316bc76ade1e6c8_floxif_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-17_81b0ffbb11e8b6a32316bc76ade1e6c8_floxif_mafia.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
MD52ae766974ba27233b9a3875bc1f2ce65
SHA16b93e73130fb70c1abf199768fef983466827bbc
SHA256acf5e22c4b1a98dc889fe2ad25626ea6fb8cce66edf1c2a4773ad4742f71203c
SHA512d579d3d14857365cf1f2cf4d7d9f29f47a4dd071d61b4dd4c1310ae2864ea2671d6d55042e49ba57600b936420f09feb3d3005047bdc317dee488ee187026b7a
-
Filesize
67KB
MD57574cf2c64f35161ab1292e2f532aabf
SHA114ba3fa927a06224dfe587014299e834def4644f
SHA256de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
SHA5124db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab
-
Filesize
1.6MB
MD5fceb62393a4a22de0848359f0334de0b
SHA11523adf20c498cd40caf153daa2e3b43ba09ce97
SHA25613a6f14cd1cf5b24b98c87c518a49a029547bb0d412f79d532efac9bd509518b
SHA5121a34f6220f3c1e42404d23298e0518f28d7a2fe29e251c9e9d352fac3db93d44885b2f1679e920373220323e088d6365d8f1a7b6cd51b2c3426b4b78fdec7a66
-
Filesize
192KB
-
Filesize
1.8MB
-
Filesize
192KB