floxif | 29254e947fb0a8c436557c9eab354e34d16555733a59beb582b134ea24d274af

General

Target

29254e947fb0a8c436557c9eab354e34d16555733a59beb582b134ea24d274afN.exe
Size

5.8MB
Sample

241217-m9dg7symhq
MD5

36e98e5ec458447058a1186301513da0
SHA1

32dfb7cedde7155748ca6540f06148471d440f79
SHA256

29254e947fb0a8c436557c9eab354e34d16555733a59beb582b134ea24d274af
SHA512

43f56a0e9851f7e3a3db6b76b1435082e9a6eba76ccf008389efd31c39037beb474f2bb585ac289d67a31940ac4c1d4dd31a515c8f2d037397b451fa4b68ce8c
SSDEEP

98304:lU/lIqbln59aY1+Xo/P4I4Zz18frP3wbzWFimaI7dlo0tA:lMltd50Y1cKLgbzWFimaI7dlhA

Score

10^/10

Malware Config

Targets

- Target
  
  29254e947fb0a8c436557c9eab354e34d16555733a59beb582b134ea24d274afN.exe
- Size
  
  5.8MB
- MD5
  
  36e98e5ec458447058a1186301513da0
- SHA1
  
  32dfb7cedde7155748ca6540f06148471d440f79
- SHA256
  
  29254e947fb0a8c436557c9eab354e34d16555733a59beb582b134ea24d274af
- SHA512
  
  43f56a0e9851f7e3a3db6b76b1435082e9a6eba76ccf008389efd31c39037beb474f2bb585ac289d67a31940ac4c1d4dd31a515c8f2d037397b451fa4b68ce8c
- SSDEEP
  
  98304:lU/lIqbln59aY1+Xo/P4I4Zz18frP3wbzWFimaI7dlo0tA:lMltd50Y1cKLgbzWFimaI7dlhA
Score

10^/10

floxif adware backdoor discovery persistence phishing spyware stealer trojan upx privilege_escalation
- Floxif family
  floxif
- Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Detects Floxif payload
  backdoor
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- A potential corporate email address has been identified in the URL: [email protected]
  phishing
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2