Overview

overview

10

Static

static

3

2024-12-18...if.exe

windows7-x64

10

2024-12-18...if.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2024-12-18_d00550eeae97b273aa18365fb2085d88_bkransomware_floxif

  • Size

    158KB

  • Sample

    241218-tw1h5swkep

  • MD5

    d00550eeae97b273aa18365fb2085d88

  • SHA1

    3a5eb693b86bd1841b3209aa4c9763f7e35ac6e8

  • SHA256

    b0c4e0ff9d22b71168a4b046cb0b452d3402f9332a09886d865333db1e79b0fc

  • SHA512

    d917c607481626320b92e852797da762488443a30a2a0f0271617587fa6d55f9b957895b72088cec9601ad717ac01bacc45404fef80dddbe18c7c6ee757d060e

  • SSDEEP

    3072:+ZFqyRX2ykQ4SR2lQBV+UdE+rECWp7hKjFH:wpX2NuBV+UdvrEFp7hKjFH

Score
10/10
floxifbackdoordiscoverypersistenceprivilege_escalationtrojanupx

Malware Config

Targets

    • Target

      2024-12-18_d00550eeae97b273aa18365fb2085d88_bkransomware_floxif

    • Size

      158KB

    • MD5

      d00550eeae97b273aa18365fb2085d88

    • SHA1

      3a5eb693b86bd1841b3209aa4c9763f7e35ac6e8

    • SHA256

      b0c4e0ff9d22b71168a4b046cb0b452d3402f9332a09886d865333db1e79b0fc

    • SHA512

      d917c607481626320b92e852797da762488443a30a2a0f0271617587fa6d55f9b957895b72088cec9601ad717ac01bacc45404fef80dddbe18c7c6ee757d060e

    • SSDEEP

      3072:+ZFqyRX2ykQ4SR2lQBV+UdE+rECWp7hKjFH:wpX2NuBV+UdvrEFp7hKjFH

    Score
    10/10
    floxifbackdoordiscoverytrojanupxpersistenceprivilege_escalation

    • Floxif family

      floxif

    • Floxif, Floodfix

      Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.

      backdoortrojanfloxif

    • Detects Floxif payload

      backdoor

    • Event Triggered Execution: AppInit DLLs

      Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

      persistenceprivilege_escalation

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks