Extracted

• • Target

    e03f8c459fed4f5579b51ccfaec32b2c5d6eaf01bdc14df9ec0531586a7b5abfN.exe

  • Size

    196KB

  • MD5

    1437986dcc72bff639730b5ddcd5c4e0

  • SHA1

    24efe4c5205aad98429b396d808ee0ae569509bb

  • SHA256

    e03f8c459fed4f5579b51ccfaec32b2c5d6eaf01bdc14df9ec0531586a7b5abf

  • SHA512

    9921904331e31a0bd1a7acae2da2d98a76a4b418119b699624c0e23ceea913a7362e1bb80ea3dd67cd0bf7f9aed27d6305783270494a47ce75467007f3394fbe

  • SSDEEP

    3072:habfe4OIN3HWlSSUGtic36N2lQBV+UdE+rECWp7hKeNSe:hEeK4SJGtDKxBV+UdvrEFp7hKm

  Score

  10^/10

  floxifsalitybackdoordiscoveryevasionpersistenceprivilege_escalationspywarestealertrojanupx

  • Floxif family

    floxif

  • Floxif, Floodfix

    Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.

    backdoortrojanfloxif

  • Modifies WinLogon for persistence

    persistence

  • Modifies firewall policy service

    evasion

  • Modifies visibility of file extensions in Explorer

    evasion

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Detects Floxif payload

    backdoor

  • Disables RegEdit via registry modification

    evasion

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Event Triggered Execution: Image File Execution Options Injection

    persistence

  • ACProtect 1.3x - 1.4x DLL software

    Detects file using ACProtect software.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2