floxif | c681fbab70197ea25b60600d87e48a924e1288832828a7a2e053bffb0523ce5d

General

Target

2024-12-19_44530fc3e22f6ad789aea170fb870d57_floxif_mafia
Size

2.4MB
Sample

241219-aqgz3ayldy
MD5

44530fc3e22f6ad789aea170fb870d57
SHA1

6ea1546109840167f6fe2cd99cf33a9cfd7b0cd9
SHA256

c681fbab70197ea25b60600d87e48a924e1288832828a7a2e053bffb0523ce5d
SHA512

f33b857260f2047adf45647bec8795a3587bd4554ea2a403f06f6caf157c603ddc58d45470336929f7dbe646841a869bc4ec44c9fadf0e703a2470919fca223c
SSDEEP

49152:2/uE7AWqIxGrGYyZa/tgrYJUGfZC3wA6EylfwEaFW31qL:3E7ARrlyutLxC3sEwwM3UL

Score

10^/10

Malware Config

Targets

- Target
  
  2024-12-19_44530fc3e22f6ad789aea170fb870d57_floxif_mafia
- Size
  
  2.4MB
- MD5
  
  44530fc3e22f6ad789aea170fb870d57
- SHA1
  
  6ea1546109840167f6fe2cd99cf33a9cfd7b0cd9
- SHA256
  
  c681fbab70197ea25b60600d87e48a924e1288832828a7a2e053bffb0523ce5d
- SHA512
  
  f33b857260f2047adf45647bec8795a3587bd4554ea2a403f06f6caf157c603ddc58d45470336929f7dbe646841a869bc4ec44c9fadf0e703a2470919fca223c
- SSDEEP
  
  49152:2/uE7AWqIxGrGYyZa/tgrYJUGfZC3wA6EylfwEaFW31qL:3E7ARrlyutLxC3sEwwM3UL
Score

10^/10

floxif backdoor bootkit discovery persistence privilege_escalation trojan upx
- Floxif family
  floxif
- Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Detects Floxif payload
  backdoor
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Network Service Discovery
  Attempt to gather information on host's network.
  discovery
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2