floxif | d408f40fd2979d73b658e619d1792652d8bbb95547a6f0f9821cf7f189108913 | Triage

Sharing

General

Target

d408f40fd2979d73b658e619d1792652d8bbb95547a6f0f9821cf7f189108913N.exe
Size

136KB
Sample

241225-3vedys1pgy
MD5

586eb0ffc1a056e2d06eaa3f8329c6e0
SHA1

1c12e93ea46aa7c71105e4a96ac0bcb72f6bae4c
SHA256

d408f40fd2979d73b658e619d1792652d8bbb95547a6f0f9821cf7f189108913
SHA512

0b0ff453af9a23e2ecd06bf7e0fc95954719bab0dd6331462a41292bdd8c08bce4e92112c92d536f0f008e0d046d849a9af5addaddb83e3fd3fd6b6ca50e06ba
SSDEEP

3072:2QIPfTXJ+9OvQRIpY2lQBV+UdE+rECWp7hKgx76PR:2Zb49nReGBV+UdvrEFp7hKgx25

Score

10^/10

floxif backdoor discovery persistence privilege_escalation trojan upx

Malware Config

Targets

- Target
  
  d408f40fd2979d73b658e619d1792652d8bbb95547a6f0f9821cf7f189108913N.exe
- Size
  
  136KB
- MD5
  
  586eb0ffc1a056e2d06eaa3f8329c6e0
- SHA1
  
  1c12e93ea46aa7c71105e4a96ac0bcb72f6bae4c
- SHA256
  
  d408f40fd2979d73b658e619d1792652d8bbb95547a6f0f9821cf7f189108913
- SHA512
  
  0b0ff453af9a23e2ecd06bf7e0fc95954719bab0dd6331462a41292bdd8c08bce4e92112c92d536f0f008e0d046d849a9af5addaddb83e3fd3fd6b6ca50e06ba
- SSDEEP
  
  3072:2QIPfTXJ+9OvQRIpY2lQBV+UdE+rECWp7hKgx76PR:2Zb49nReGBV+UdvrEFp7hKgx25
Score

10^/10

floxif backdoor discovery trojan upx persistence privilege_escalation
- Floxif family
  floxif
- Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Detects Floxif payload
  backdoor
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/FindProcDLL.dll
- Size
  
  3KB
- MD5
  
  75e7351a0f836b8659e6f315683c29f7
- SHA1
  
  66b733d1c978d68cadc245e7efbfcae32807429d
- SHA256
  
  7ffc549e7f679a08c77fa230654b77cdffb3444296bb7c6b8b5769db374b61ee
- SHA512
  
  f03400798b07ccca5e12fa119a586ee9444deb0d2419aced24d93fd84a4702d66864a71b40a11b04b1dbe56e36481cd6a644aec0347bc82bc7375b27bc403fe4
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  
  $PLUGINSDIR/StdUtils.dll
- Size
  
  14KB
- MD5
  
  21010df9bc37daffcc0b5ae190381d85
- SHA1
  
  a8ba022aafc1233894db29e40e569dfc8b280eb9
- SHA256
  
  0ebd62de633fa108cf18139be6778fa560680f9f8a755e41c6ab544ab8db5c16
- SHA512
  
  95d3dbba6eac144260d5fcc7fcd5fb3afcb59ae62bd2eafc5a1d2190e9b44f8e125290d62fef82ad8799d0072997c57b2fa8a643aba554d0a82bbd3f8eb1403e
- SSDEEP
  
  192:OFb8Y8oqy2mqZc9hGBQHRx39oRxmMvURkB/Fs:qb8Y8nKqohGBKxox9vURw/a
Score

3^/10

discovery
behavioral5 behavioral6

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

AppInit DLLs

Privilege Escalation

Event Triggered Execution

AppInit DLLs

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

floxifbackdoordiscoverytrojanupx

behavioral2

floxifbackdoordiscoverypersistenceprivilege_escalationtrojanupx

behavioral3

behavioral4

behavioral5

behavioral6