Overview

overview

10

Static

static

1

2024-12-26...er.exe

windows7-x64

10

2024-12-26...er.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2024-12-26_6b299b7ceecc9ede0b2d915e2179258a_floxif_magniber

  • Size

    1.8MB

  • Sample

    241226-pml7yavqev

  • MD5

    6b299b7ceecc9ede0b2d915e2179258a

  • SHA1

    f79839791b683ea852d5f884acdfc6efc59ef255

  • SHA256

    8065d6efdb73cc2b87c2c6814c901f8248ce23cea91cef57ed8d80d20987f154

  • SHA512

    fbca75ae632b21756878e9bc03e386d9651f969f5ed736681739eadb4ab03392ced600c7c581775ac1daefe8a798d6468e3170b466d5b5becaf1a72b0bb44f6a

  • SSDEEP

    24576:rqyoppMC3ezCb30zKiKYl+3+Bk5N9ndZlW0Uc04KzThfuvG51rI283VroatPg3+X:zQbkzSYl+uFUUhf3LIt3VEarMlyd

Score
10/10
floxifbackdoorbootkitdiscoverypersistencetrojanupx

Malware Config

Targets

    • Target

      2024-12-26_6b299b7ceecc9ede0b2d915e2179258a_floxif_magniber

    • Size

      1.8MB

    • MD5

      6b299b7ceecc9ede0b2d915e2179258a

    • SHA1

      f79839791b683ea852d5f884acdfc6efc59ef255

    • SHA256

      8065d6efdb73cc2b87c2c6814c901f8248ce23cea91cef57ed8d80d20987f154

    • SHA512

      fbca75ae632b21756878e9bc03e386d9651f969f5ed736681739eadb4ab03392ced600c7c581775ac1daefe8a798d6468e3170b466d5b5becaf1a72b0bb44f6a

    • SSDEEP

      24576:rqyoppMC3ezCb30zKiKYl+3+Bk5N9ndZlW0Uc04KzThfuvG51rI283VroatPg3+X:zQbkzSYl+uFUUhf3LIt3VEarMlyd

    Score
    10/10
    floxifbackdoorbootkitdiscoverypersistencetrojanupx

    • Floxif family

      floxif

    • Floxif, Floodfix

      Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.

      backdoortrojanfloxif

    • Detects Floxif payload

      backdoor

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks