General

  • Target

    2024-11-20_76d77b1f34e2bf39822898e8816d05e0_floxif_mafia

  • Size

    4.6MB

  • Sample

    241120-ps9v7awglc

  • MD5

    76d77b1f34e2bf39822898e8816d05e0

  • SHA1

    c9be7b0559214dc213a7683d65c3c297bd65b341

  • SHA256

    dfcffb34807588c8b5f16e476bdeee314fc86c48b0f78fa3a4031cac4857f176

  • SHA512

    35e860cd7ec87e472c819c383ab1f4a94686727b64a5448a7e2161508b08d464b4be290fad8b4239e312a6809a11fdcc95e4bd98c63a2aa6fede346f4eafc8d0

  • SSDEEP

    98304:MOR2WCuKXZr82AKRFA/grN1JNTEM9tNYcSrUCAviXvTvXauWCr1pcgD5Owk8Y:v+u+kANPt4rUCAsTvXaRCVOPF

Malware Config

Targets

    • Target

      2024-11-20_76d77b1f34e2bf39822898e8816d05e0_floxif_mafia

    • Size

      4.6MB

    • MD5

      76d77b1f34e2bf39822898e8816d05e0

    • SHA1

      c9be7b0559214dc213a7683d65c3c297bd65b341

    • SHA256

      dfcffb34807588c8b5f16e476bdeee314fc86c48b0f78fa3a4031cac4857f176

    • SHA512

      35e860cd7ec87e472c819c383ab1f4a94686727b64a5448a7e2161508b08d464b4be290fad8b4239e312a6809a11fdcc95e4bd98c63a2aa6fede346f4eafc8d0

    • SSDEEP

      98304:MOR2WCuKXZr82AKRFA/grN1JNTEM9tNYcSrUCAviXvTvXauWCr1pcgD5Owk8Y:v+u+kANPt4rUCAsTvXaRCVOPF

    • Floxif family

    • Floxif, Floodfix

      Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.

    • Detects Floxif payload

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks