General

  • Target

    476e9229a0a3e73cccd8cbb595b362d6419bed6b0db729289319141e09307f89

  • Size

    277KB

  • Sample

    241109-nmc4laspd1

  • MD5

    970023c7457f64f87ea51a08e1074255

  • SHA1

    1e04d495fe1cf26cbd17fe5a427d120512027afa

  • SHA256

    476e9229a0a3e73cccd8cbb595b362d6419bed6b0db729289319141e09307f89

  • SHA512

    7c23f88c72776c793731e3d37e3b1b34001842a007b23ea65c33ff5b15bff1b13a13e71ff4de2214e14587b121de292f9a7fab11b54eaabb4abd9ff6da0c4f53

  • SSDEEP

    6144:AA8l/D6zTC3dM7B+mCGBV+UdvrEFp7hKrGQ:AA8lb6zy6B+mCGBjvrEH7qGQ

Malware Config

Targets

    • Target

      476e9229a0a3e73cccd8cbb595b362d6419bed6b0db729289319141e09307f89

    • Size

      277KB

    • MD5

      970023c7457f64f87ea51a08e1074255

    • SHA1

      1e04d495fe1cf26cbd17fe5a427d120512027afa

    • SHA256

      476e9229a0a3e73cccd8cbb595b362d6419bed6b0db729289319141e09307f89

    • SHA512

      7c23f88c72776c793731e3d37e3b1b34001842a007b23ea65c33ff5b15bff1b13a13e71ff4de2214e14587b121de292f9a7fab11b54eaabb4abd9ff6da0c4f53

    • SSDEEP

      6144:AA8l/D6zTC3dM7B+mCGBV+UdvrEFp7hKrGQ:AA8lb6zy6B+mCGBjvrEH7qGQ

    • Floxif family

    • Floxif, Floodfix

      Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.

    • Detects Floxif payload

    • Event Triggered Execution: AppInit DLLs

      Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks