floxif | 742a1e53921514df24066cbd99bdcd8fc2ef4e8844e11081dec1d3fb9bd04271

General

Target

2024-12-22_32e8e24340fa0f8050e9fed244de8451_floxif_icedid
Size

22.3MB
Sample

241222-rpks1a1kfy
MD5

32e8e24340fa0f8050e9fed244de8451
SHA1

ebddf519a2b0d78b515250f1eec465db4b6cdbfa
SHA256

742a1e53921514df24066cbd99bdcd8fc2ef4e8844e11081dec1d3fb9bd04271
SHA512

6149ab231a92316a8672ba8a01bb7c829ad0efd629b48706b097a8973d7b25a96773dac54efb2d4d9c07f5bd48eab48f8d26545e276c82a950fbf288ddcf576e
SSDEEP

393216:GXYKjHs4737sM3HgVrAmIQoLd28A+a0r/DdXLnEsRgcHcqcp0q3WI28d+olEj:GXYKLsstBg89xDdbn8c8qk3N2Qlu

Score

10^/10

Malware Config

Targets

- Target
  
  2024-12-22_32e8e24340fa0f8050e9fed244de8451_floxif_icedid
- Size
  
  22.3MB
- MD5
  
  32e8e24340fa0f8050e9fed244de8451
- SHA1
  
  ebddf519a2b0d78b515250f1eec465db4b6cdbfa
- SHA256
  
  742a1e53921514df24066cbd99bdcd8fc2ef4e8844e11081dec1d3fb9bd04271
- SHA512
  
  6149ab231a92316a8672ba8a01bb7c829ad0efd629b48706b097a8973d7b25a96773dac54efb2d4d9c07f5bd48eab48f8d26545e276c82a950fbf288ddcf576e
- SSDEEP
  
  393216:GXYKjHs4737sM3HgVrAmIQoLd28A+a0r/DdXLnEsRgcHcqcp0q3WI28d+olEj:GXYKLsstBg89xDdbn8c8qk3N2Qlu
Score

10^/10

floxif backdoor discovery persistence privilege_escalation trojan upx
- Floxif family
  floxif
- Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Detects Floxif payload
  backdoor
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- Manipulates Digital Signatures
  Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2