General
-
Target
5a5d7f176315fc22bfd26d6444a2579c032f4e8452c1f09a6478b5655d79eaa0N.exe
-
Size
1.6MB
-
Sample
241226-ypme6axnem
-
MD5
6cd9d14f77f74c8ca86a6f13ad88c640
-
SHA1
0ba25df509f6ee0c714348925fd22a31442772e0
-
SHA256
5a5d7f176315fc22bfd26d6444a2579c032f4e8452c1f09a6478b5655d79eaa0
-
SHA512
f28323fb582efade2a9f13626dfda08c70ecca9bf0416d44aa3b93baa3a6adb2ffa56fe5e66334ae4465c1de86f9afe657f65caed9eba86cf6e1ca9917c9724e
-
SSDEEP
49152:yfF/avsilbmSCvbprL6EPKcNHvGl9k8FGKu9:yarlqPvbpP6ENGlSCu9
Malware Config
Targets
-
-
Target
5a5d7f176315fc22bfd26d6444a2579c032f4e8452c1f09a6478b5655d79eaa0N.exe
-
Size
1.6MB
-
MD5
6cd9d14f77f74c8ca86a6f13ad88c640
-
SHA1
0ba25df509f6ee0c714348925fd22a31442772e0
-
SHA256
5a5d7f176315fc22bfd26d6444a2579c032f4e8452c1f09a6478b5655d79eaa0
-
SHA512
f28323fb582efade2a9f13626dfda08c70ecca9bf0416d44aa3b93baa3a6adb2ffa56fe5e66334ae4465c1de86f9afe657f65caed9eba86cf6e1ca9917c9724e
-
SSDEEP
49152:yfF/avsilbmSCvbprL6EPKcNHvGl9k8FGKu9:yarlqPvbpP6ENGlSCu9
Score10/10-
Floxif family
-
Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
-
Detects Floxif payload
-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-