Detect Neshta payload

Floxif, Floodfix

Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.

Modifies firewall policy service

Modifies security service

Modifies visiblity of hidden/system files in Explorer

Neshta

Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

UAC bypass

Windows security bypass

Detects Floxif payload

Disables RegEdit via registry modification

Disables Task Manager via registry modification

Drops file in Drivers directory

Sets service image path in registry