General
-
Target
2024-10-30_9b96bb0642e2665096d9f55905456b09_floxif_icedid
-
Size
14.0MB
-
Sample
241030-xhb56szarf
-
MD5
9b96bb0642e2665096d9f55905456b09
-
SHA1
aa1d4448549480f49adff7dba282042d766c0771
-
SHA256
fb491e160ff7c68719378487269a5430ec08bf28b4aa223df8e2af49292f8d4d
-
SHA512
9ac9a5fc4ca0c87514e22d6fb0676e8d3c9757d23ea26b68ae30ac542b2b0536350ebcf6be9228756b5a748151eed14c15191a24a73d6b52b02181c8560bc9cb
-
SSDEEP
196608:OYSexZiwA6dwpTyUxqZBrSnM77MzyP8hjVVhAOltnZgsm2:vtwvwUMfMzzhhVhAOLnb
Static task
static1
Behavioral task
behavioral1
Sample
2024-10-30_9b96bb0642e2665096d9f55905456b09_floxif_icedid.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-10-30_9b96bb0642e2665096d9f55905456b09_floxif_icedid.exe
Resource
win10v2004-20241007-en
Malware Config
Targets
-
-
Target
2024-10-30_9b96bb0642e2665096d9f55905456b09_floxif_icedid
-
Size
14.0MB
-
MD5
9b96bb0642e2665096d9f55905456b09
-
SHA1
aa1d4448549480f49adff7dba282042d766c0771
-
SHA256
fb491e160ff7c68719378487269a5430ec08bf28b4aa223df8e2af49292f8d4d
-
SHA512
9ac9a5fc4ca0c87514e22d6fb0676e8d3c9757d23ea26b68ae30ac542b2b0536350ebcf6be9228756b5a748151eed14c15191a24a73d6b52b02181c8560bc9cb
-
SSDEEP
196608:OYSexZiwA6dwpTyUxqZBrSnM77MzyP8hjVVhAOltnZgsm2:vtwvwUMfMzzhhVhAOLnb
-
Floxif family
-
Detects Floxif payload
-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Blocklisted process makes network request
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1