General

  • Target

    71ddf7ae772de3bf133246ebc4319572b7e3b45e14f01e36d2aa790ea451a203

  • Size

    286KB

  • Sample

    241110-bycwrazjck

  • MD5

    83f9b26fd039d6d8f34b03067c3bc316

  • SHA1

    404b5824c43d079ce9121b85d35bda573eb826c3

  • SHA256

    71ddf7ae772de3bf133246ebc4319572b7e3b45e14f01e36d2aa790ea451a203

  • SHA512

    0ac926cd001fddb81bb274fa9de214241e67d04a915cb4854ba39a87bfd43b15835efcfdbafbc493e9024d43a0f92ebb8aea6b22cdc7611fea5581178bb49b9e

  • SSDEEP

    6144:SJgKNkhSR/5kHouyXnZhB+h8WHlBV+UdvrEFp7hK2WTUP:SJgKNkhm/JuyXnPB+h8WHlBjvrEH7OUP

Malware Config

Targets

    • Target

      71ddf7ae772de3bf133246ebc4319572b7e3b45e14f01e36d2aa790ea451a203

    • Size

      286KB

    • MD5

      83f9b26fd039d6d8f34b03067c3bc316

    • SHA1

      404b5824c43d079ce9121b85d35bda573eb826c3

    • SHA256

      71ddf7ae772de3bf133246ebc4319572b7e3b45e14f01e36d2aa790ea451a203

    • SHA512

      0ac926cd001fddb81bb274fa9de214241e67d04a915cb4854ba39a87bfd43b15835efcfdbafbc493e9024d43a0f92ebb8aea6b22cdc7611fea5581178bb49b9e

    • SSDEEP

      6144:SJgKNkhSR/5kHouyXnZhB+h8WHlBV+UdvrEFp7hK2WTUP:SJgKNkhm/JuyXnPB+h8WHlBjvrEH7OUP

    • Floxif family

    • Floxif, Floodfix

      Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.

    • Detects Floxif payload

    • Event Triggered Execution: AppInit DLLs

      Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks