Overview

overview

10

Static

static

3

ccafee8756...cN.exe

windows7-x64

10

ccafee8756...cN.exe

windows10-2004-x64

10

$PLUGINSDI...LL.dll

windows7-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...sh.dll

windows7-x64

3

$PLUGINSDI...sh.dll

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ccafee8756dcf22bd7da369faa218878726b5b13ab74eda6896a5150b0e41decN.exe

  • Size

    136KB

  • Sample

    241226-t3v71azrf1

  • MD5

    6b78037c04c16055ffc223d595025520

  • SHA1

    7cd57e2cdaba14f6ed4dac1a39b5369d6928e8ac

  • SHA256

    ccafee8756dcf22bd7da369faa218878726b5b13ab74eda6896a5150b0e41dec

  • SHA512

    6094938591f323e27842362916caaf8898ad931537e15d4a24481d5220d4b57835b4c2082cdc1940b9029d8cc176d1d5875e537052019efddf5d4b20cffb0da9

  • SSDEEP

    3072:sQIgGTXJgoaiCA89kiTYGsMP2lQBV+UdE+rECWp7hKfx76PnR:s+yORrkU5BV+UdvrEFp7hKfx25

Score
10/10
floxifbackdoordiscoverypersistenceprivilege_escalationtrojanupx

Malware Config

Targets

    • Target

      ccafee8756dcf22bd7da369faa218878726b5b13ab74eda6896a5150b0e41decN.exe

    • Size

      136KB

    • MD5

      6b78037c04c16055ffc223d595025520

    • SHA1

      7cd57e2cdaba14f6ed4dac1a39b5369d6928e8ac

    • SHA256

      ccafee8756dcf22bd7da369faa218878726b5b13ab74eda6896a5150b0e41dec

    • SHA512

      6094938591f323e27842362916caaf8898ad931537e15d4a24481d5220d4b57835b4c2082cdc1940b9029d8cc176d1d5875e537052019efddf5d4b20cffb0da9

    • SSDEEP

      3072:sQIgGTXJgoaiCA89kiTYGsMP2lQBV+UdE+rECWp7hKfx76PnR:s+yORrkU5BV+UdvrEFp7hKfx25

    Score
    10/10
    floxifbackdoordiscoverypersistenceprivilege_escalationtrojanupx

    • Floxif family

      floxif

    • Floxif, Floodfix

      Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.

      backdoortrojanfloxif

    • Detects Floxif payload

      backdoor

    • Event Triggered Execution: AppInit DLLs

      Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

      persistenceprivilege_escalation

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

    • Target

      $PLUGINSDIR/FindProcDLL.dll

    • Size

      3KB

    • MD5

      75e7351a0f836b8659e6f315683c29f7

    • SHA1

      66b733d1c978d68cadc245e7efbfcae32807429d

    • SHA256

      7ffc549e7f679a08c77fa230654b77cdffb3444296bb7c6b8b5769db374b61ee

    • SHA512

      f03400798b07ccca5e12fa119a586ee9444deb0d2419aced24d93fd84a4702d66864a71b40a11b04b1dbe56e36481cd6a644aec0347bc82bc7375b27bc403fe4

    Score
    3/10
    discovery
    behavioral3behavioral4

    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      a78507ea1078cadaa8b2ec1a2e1d874f

    • SHA1

      77fe20488444ebbaafc5b2c0743251a94edc3b8e

    • SHA256

      93d1e681daebfd24ff9fab3952e8ae94eddbdfb3650937988c1fd8085991610e

    • SHA512

      0399452c7305f23576d4175ec198ad8da8a530215e9304632b20bcb41a38fa0ba2c1c0b0b734b9f887851c92c7f2cf4cdfad403ace84e63318c0694402e1f270

    • SSDEEP

      192:8trS5c+oKreH53n2fUC1lfeTf9OJCzD4/IVqh88GrgU6H:/jrd09O3/IcG8U6H

    Score
    3/10
    discovery
    behavioral5behavioral6

    • Target

      $PLUGINSDIR/newadvsplash.dll

    • Size

      8KB

    • MD5

      7ee14dff57fb6e6c644b318d16768f4c

    • SHA1

      9a5d5b31ab56ab01e9b0bd76c51b8b4605a8ccce

    • SHA256

      53377d0710f551182edbab4150935425948535d11b92bf08a1c2dcf989723bd7

    • SHA512

      0565ff2bdbdf044c5f90bd45475d478b48cdbd5e19569976291b1bdd703e61355410c65f29f2c9213faf56251beb16d342c8625288dad6afc670717b9636d51f

    • SSDEEP

      96:qD5UDaGxZH52QhtZafDP9BTS9nPg83UniV/zRzGEl1DMl1zN6LmeYt4dO:W5UDaGxZH5T0j+9nl3BzG0IZ6LqN

    Score
    3/10
    discovery
    behavioral7behavioral8

MITRE ATT&CK Enterprise v15

Tasks