floxif | 91bffedf20a7ee907467bfbd438e7563c58ccfcbfddc1f643f181e84defcb309 | Triage

Submit
Reports

Overview

overview

Static

static

5

91bffedf20...9N.exe

windows7-x64

91bffedf20...9N.exe

windows10-2004-x64

Sharing

General

Target

91bffedf20a7ee907467bfbd438e7563c58ccfcbfddc1f643f181e84defcb309N
Size

542KB
Sample

241110-x3c8zatdlg
MD5

f6d04f1393c6d6fb00dfe992ab74fb50
SHA1

53cbd0f366a5aece240e9fe87d059fc831061faf
SHA256

91bffedf20a7ee907467bfbd438e7563c58ccfcbfddc1f643f181e84defcb309
SHA512

7622402d9bd899f7532a0f2c16ac8c17eeaf05fe0a69e767d30baabdca41a1aeb8482bda58acba61bf8731ec1b4f3f1acba0e12bdb4513eb9f153d26abd19cd8
SSDEEP

12288:r5jceGOnUt8h5zorF/UqyWxSa/5NWgdFmAJF6jduBjvrEH76M:+ezU8wrlzWgdwAidIrEH7P

Score

10^/10

floxif modiloader backdoor discovery persistence trojan upx

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

91bffedf20a7ee907467bfbd438e7563c58ccfcbfddc1f643f181e84defcb309N.exe

Resource

win7-20241023-en

floxif modiloader backdoor discovery persistence trojan upx

windows7-x64

19 signatures

120 seconds

Behavioral task

behavioral2

Sample

91bffedf20a7ee907467bfbd438e7563c58ccfcbfddc1f643f181e84defcb309N.exe

Resource

win10v2004-20241007-en

floxif modiloader backdoor discovery persistence trojan upx

windows10-2004-x64

19 signatures

120 seconds

Malware Config

Targets

- Target
  
  91bffedf20a7ee907467bfbd438e7563c58ccfcbfddc1f643f181e84defcb309N
- Size
  
  542KB
- MD5
  
  f6d04f1393c6d6fb00dfe992ab74fb50
- SHA1
  
  53cbd0f366a5aece240e9fe87d059fc831061faf
- SHA256
  
  91bffedf20a7ee907467bfbd438e7563c58ccfcbfddc1f643f181e84defcb309
- SHA512
  
  7622402d9bd899f7532a0f2c16ac8c17eeaf05fe0a69e767d30baabdca41a1aeb8482bda58acba61bf8731ec1b4f3f1acba0e12bdb4513eb9f153d26abd19cd8
- SSDEEP
  
  12288:r5jceGOnUt8h5zorF/UqyWxSa/5NWgdFmAJF6jduBjvrEH76M:+ezU8wrlzWgdwAidIrEH7P
Score

10^/10

floxif modiloader backdoor discovery persistence trojan upx
- Floxif family
  floxif
- Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- Modiloader family
  modiloader
- Detects Floxif payload
  backdoor
- ModiLoader First Stage
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

floxifmodiloaderbackdoordiscoverypersistencetrojanupx

behavioral2

floxifmodiloaderbackdoordiscoverypersistencetrojanupx

© 2018-2024

Terms | Privacy