floxif | 012424a394a9058782613a0425b1afd884fc46de36e70089f668095721075aff

General

Target

012424a394a9058782613a0425b1afd884fc46de36e70089f668095721075affN
Size

5.8MB
Sample

241110-jeev1avrfk
MD5

5881184e8a0254680de7a6044c5e0470
SHA1

61af39637a7f12aa7254e2c92922cd320c830811
SHA256

012424a394a9058782613a0425b1afd884fc46de36e70089f668095721075aff
SHA512

b5260dcf235724572da8e9f99803af38c9664ced977c58b0166dde44bb8c9fc87193908c61eae65b5c6c4c6dd1908b73eea4d234671f2771a29675d6fd8d6b3c
SSDEEP

98304:XYvIlp+8z1cwOKN3P4R18frP3wbzWFimaI7dlo5:qIlo8zC4N5gbzWFimaI7dlG

Score

10^/10

Malware Config

Targets

- Target
  
  012424a394a9058782613a0425b1afd884fc46de36e70089f668095721075affN
- Size
  
  5.8MB
- MD5
  
  5881184e8a0254680de7a6044c5e0470
- SHA1
  
  61af39637a7f12aa7254e2c92922cd320c830811
- SHA256
  
  012424a394a9058782613a0425b1afd884fc46de36e70089f668095721075aff
- SHA512
  
  b5260dcf235724572da8e9f99803af38c9664ced977c58b0166dde44bb8c9fc87193908c61eae65b5c6c4c6dd1908b73eea4d234671f2771a29675d6fd8d6b3c
- SSDEEP
  
  98304:XYvIlp+8z1cwOKN3P4R18frP3wbzWFimaI7dlo5:qIlo8zC4N5gbzWFimaI7dlG
Score

10^/10

floxif adware backdoor discovery persistence phishing spyware stealer trojan upx privilege_escalation
- Floxif family
  floxif
- Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Detects Floxif payload
  backdoor
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- A potential corporate email address has been identified in the URL: [email protected]
  phishing
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2