General

  • Target

    2024-11-09_afcb07f7d15daf55232ebe9ccb174ca2_floxif_mafia

  • Size

    312KB

  • Sample

    241109-psdsravbnb

  • MD5

    afcb07f7d15daf55232ebe9ccb174ca2

  • SHA1

    a86f1f535ef2d0b6303f03c099d49a813dbccdae

  • SHA256

    54be9eb9069a92094442bea0df0bd35819bb5513a0bd1b5fb7e489379d465647

  • SHA512

    04061a3190b6a2509241bd8593868da1fe62ec9bf77fcd036f055e3ab06b26ec8c18f8c8755bb18442a8377f38ad0f5dd3cdb965bfb1503c0e97d38ce037e267

  • SSDEEP

    6144:9cRx7CRDMJ+eXkCpCq2ixv/imtb1lBV+UdvrEFp7hK+4:9gxKDTukCAq2ixCmtbzBjvrEH7/4

Malware Config

Targets

    • Target

      2024-11-09_afcb07f7d15daf55232ebe9ccb174ca2_floxif_mafia

    • Size

      312KB

    • MD5

      afcb07f7d15daf55232ebe9ccb174ca2

    • SHA1

      a86f1f535ef2d0b6303f03c099d49a813dbccdae

    • SHA256

      54be9eb9069a92094442bea0df0bd35819bb5513a0bd1b5fb7e489379d465647

    • SHA512

      04061a3190b6a2509241bd8593868da1fe62ec9bf77fcd036f055e3ab06b26ec8c18f8c8755bb18442a8377f38ad0f5dd3cdb965bfb1503c0e97d38ce037e267

    • SSDEEP

      6144:9cRx7CRDMJ+eXkCpCq2ixv/imtb1lBV+UdvrEFp7hK+4:9gxKDTukCAq2ixCmtbzBjvrEH7/4

    • Floxif family

    • Floxif, Floodfix

      Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.

    • Detects Floxif payload

    • Event Triggered Execution: AppInit DLLs

      Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks