General

  • Target

    2024-12-18_280a7fda0c2634bf6263538b0c977e19_floxif_icedid

  • Size

    5.1MB

  • Sample

    241218-zb2hla1jf1

  • MD5

    280a7fda0c2634bf6263538b0c977e19

  • SHA1

    0643bb8b25ad4f1d10b730df001c38050bff0a2e

  • SHA256

    7d1e47a5ad6dbb251c349247de9d6c5b4d3da438c49978586d5082370efa0bc1

  • SHA512

    9b6216930f8cf1df9032a8a6db663130d1793eec641a8fb36eb949ae67f7119bcef25a81bc1f1f20b23adbf65601f8519e79a2f256a564598716f4b19743c61b

  • SSDEEP

    98304:+mY2F/p8vn19RXuJkHrBY2h/8d6eVU1k1UW2/8RG4O3VUa5CrNBDNUMqmCgy8VnH:+mY2Npc/Re6HHh/8cEUS1h2/uG4O3urt

Malware Config

Targets

    • Target

      2024-12-18_280a7fda0c2634bf6263538b0c977e19_floxif_icedid

    • Size

      5.1MB

    • MD5

      280a7fda0c2634bf6263538b0c977e19

    • SHA1

      0643bb8b25ad4f1d10b730df001c38050bff0a2e

    • SHA256

      7d1e47a5ad6dbb251c349247de9d6c5b4d3da438c49978586d5082370efa0bc1

    • SHA512

      9b6216930f8cf1df9032a8a6db663130d1793eec641a8fb36eb949ae67f7119bcef25a81bc1f1f20b23adbf65601f8519e79a2f256a564598716f4b19743c61b

    • SSDEEP

      98304:+mY2F/p8vn19RXuJkHrBY2h/8d6eVU1k1UW2/8RG4O3VUa5CrNBDNUMqmCgy8VnH:+mY2Npc/Re6HHh/8cEUS1h2/uG4O3urt

    • Floxif family

    • Floxif, Floodfix

      Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.

    • Detects Floxif payload

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Executes dropped EXE

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks