Overview

overview

10

Static

static

1

2024-12-26...ia.exe

windows7-x64

10

2024-12-26...ia.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2024-12-26_5c3826170f56848c652687b008a87b6c_floxif_hijackloader_mafia

  • Size

    2.7MB

  • Sample

    241226-pmah5svqdy

  • MD5

    5c3826170f56848c652687b008a87b6c

  • SHA1

    fb5a889a2a7d8457f3b4cd42335bb5a840205589

  • SHA256

    b92e55799629e876e75a6641f5569a22f079ad5eda3110a6fbc84372d91de7aa

  • SHA512

    ec1ceef236cab95ee66f20259b570b944dcfa3db2c7c7a91625ecad86c3ff92fb12c9a7d723b12d8d073ef4d6ca439993104a49df3872d5c9ff88d27918fb139

  • SSDEEP

    49152:2Pf6VdMQTNRbgkshkNw//7vgseqziRS1UsrzoeNFZe45c71y9Bx4M3W/KMZKWKKt:2q1Rfssw//7vgVqziRS1UsrzppD5y1yO

Score
10/10
floxifbackdoordiscoverypersistenceprivilege_escalationtrojanupx

Malware Config

Targets

    • Target

      2024-12-26_5c3826170f56848c652687b008a87b6c_floxif_hijackloader_mafia

    • Size

      2.7MB

    • MD5

      5c3826170f56848c652687b008a87b6c

    • SHA1

      fb5a889a2a7d8457f3b4cd42335bb5a840205589

    • SHA256

      b92e55799629e876e75a6641f5569a22f079ad5eda3110a6fbc84372d91de7aa

    • SHA512

      ec1ceef236cab95ee66f20259b570b944dcfa3db2c7c7a91625ecad86c3ff92fb12c9a7d723b12d8d073ef4d6ca439993104a49df3872d5c9ff88d27918fb139

    • SSDEEP

      49152:2Pf6VdMQTNRbgkshkNw//7vgseqziRS1UsrzoeNFZe45c71y9Bx4M3W/KMZKWKKt:2q1Rfssw//7vgVqziRS1UsrzppD5y1yO

    Score
    10/10
    floxifbackdoordiscoverypersistenceprivilege_escalationtrojanupx

    • Floxif family

      floxif

    • Floxif, Floodfix

      Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.

      backdoortrojanfloxif

    • Detects Floxif payload

      backdoor

    • Event Triggered Execution: AppInit DLLs

      Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

      persistenceprivilege_escalation

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks