Overview

overview

10

Static

static

1

2024-12-20...ia.exe

windows7-x64

10

2024-12-20...ia.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2024-12-20_42a3ea277ade4cec47454a18530791a1_floxif_mafia

  • Size

    708KB

  • Sample

    241220-rpks1ayjfn

  • MD5

    42a3ea277ade4cec47454a18530791a1

  • SHA1

    60f18b4380addf617b14b49c36fe3706893e3eb9

  • SHA256

    90d1a5f58f9731a5d643f00044d6f373639f23e11a167a8e988e7160cc19199a

  • SHA512

    0f684cf56ea1d30caaf52fd1e97ce0aeeddbfa398979f2f0d8b598e392d9bbded9dcf23913d83abf312ad255831fc03202becb0816049ff553862e2a88c21f59

  • SSDEEP

    12288:uvN7t3capRpLJt9LpCJpBQidO72sZVTsWbVKFFf3FRcow6JVBjvrEH7Tx:uNtMapztLOpFVsPTnbVy9FRcVKbrEH7V

Score
10/10
floxifbackdoordiscoverypersistenceprivilege_escalationtrojanupx

Malware Config

Targets

    • Target

      2024-12-20_42a3ea277ade4cec47454a18530791a1_floxif_mafia

    • Size

      708KB

    • MD5

      42a3ea277ade4cec47454a18530791a1

    • SHA1

      60f18b4380addf617b14b49c36fe3706893e3eb9

    • SHA256

      90d1a5f58f9731a5d643f00044d6f373639f23e11a167a8e988e7160cc19199a

    • SHA512

      0f684cf56ea1d30caaf52fd1e97ce0aeeddbfa398979f2f0d8b598e392d9bbded9dcf23913d83abf312ad255831fc03202becb0816049ff553862e2a88c21f59

    • SSDEEP

      12288:uvN7t3capRpLJt9LpCJpBQidO72sZVTsWbVKFFf3FRcow6JVBjvrEH7Tx:uNtMapztLOpFVsPTnbVy9FRcVKbrEH7V

    Score
    10/10
    floxifbackdoordiscoverypersistenceprivilege_escalationtrojanupx

    • Floxif family

      floxif

    • Floxif, Floodfix

      Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.

      backdoortrojanfloxif

    • Detects Floxif payload

      backdoor

    • Event Triggered Execution: AppInit DLLs

      Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

      persistenceprivilege_escalation

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks