General

  • Target

    9e9df320082b2c2d43a9e58143a7eff72ce26216c02226029989d3c798994002

  • Size

    562KB

  • Sample

    241225-xhbveatjdk

  • MD5

    a8cce138f69c883c2c9fa30d7028871e

  • SHA1

    913f73d0173a00aa7120bd0684d6e2c312514b17

  • SHA256

    9e9df320082b2c2d43a9e58143a7eff72ce26216c02226029989d3c798994002

  • SHA512

    5dfc8851620e2fb7feadc92e23e6ee98037fa531156d4878f36600e0ed22e9328e9412f4d4c7ea5785082033858476e8c543e9287e55559ef31366863a3d531c

  • SSDEEP

    12288:YnR+T6jdSeQjHRmwEGP4/uSlvdG4BjvrEH7e:YnR+T6BSeQ74fGivd3rEH7e

Malware Config

Targets

    • Target

      9e9df320082b2c2d43a9e58143a7eff72ce26216c02226029989d3c798994002

    • Size

      562KB

    • MD5

      a8cce138f69c883c2c9fa30d7028871e

    • SHA1

      913f73d0173a00aa7120bd0684d6e2c312514b17

    • SHA256

      9e9df320082b2c2d43a9e58143a7eff72ce26216c02226029989d3c798994002

    • SHA512

      5dfc8851620e2fb7feadc92e23e6ee98037fa531156d4878f36600e0ed22e9328e9412f4d4c7ea5785082033858476e8c543e9287e55559ef31366863a3d531c

    • SSDEEP

      12288:YnR+T6jdSeQjHRmwEGP4/uSlvdG4BjvrEH7e:YnR+T6BSeQ74fGivd3rEH7e

    • Floxif family

    • Floxif, Floodfix

      Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.

    • Detects Floxif payload

    • Event Triggered Execution: AppInit DLLs

      Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks