General
-
Target
e9b15b20632c0bc7e12cf25a5f090f6ddab72e307c1f08b7eeccea1ff5d0ac5b
-
Size
3.3MB
-
Sample
241227-egekss1nds
-
MD5
8814f6676f299c514df1c2b855e7f4cc
-
SHA1
5ac956b893e336e7bc53b4eb0aa5c44f5efbc53a
-
SHA256
e9b15b20632c0bc7e12cf25a5f090f6ddab72e307c1f08b7eeccea1ff5d0ac5b
-
SHA512
4f60cc36dd5f9bcc31d31d68306fcbc506c7fb9e20cb94f20a6570b2deff5615a0043f56644754a51bc2acce368c9955dd1c37fb32803d88f950e3ca7436c0d1
-
SSDEEP
49152:9jpCiSC7VLqrZu1xBwnIYl5+792VwknqotEFMkY+UBMoEnRqlrMz0FBcbZAjxnMj:9Or6PE+79edqj27+UBxcRqlr1BSuMj
Malware Config
Targets
-
-
Target
e9b15b20632c0bc7e12cf25a5f090f6ddab72e307c1f08b7eeccea1ff5d0ac5b
-
Size
3.3MB
-
MD5
8814f6676f299c514df1c2b855e7f4cc
-
SHA1
5ac956b893e336e7bc53b4eb0aa5c44f5efbc53a
-
SHA256
e9b15b20632c0bc7e12cf25a5f090f6ddab72e307c1f08b7eeccea1ff5d0ac5b
-
SHA512
4f60cc36dd5f9bcc31d31d68306fcbc506c7fb9e20cb94f20a6570b2deff5615a0043f56644754a51bc2acce368c9955dd1c37fb32803d88f950e3ca7436c0d1
-
SSDEEP
49152:9jpCiSC7VLqrZu1xBwnIYl5+792VwknqotEFMkY+UBMoEnRqlrMz0FBcbZAjxnMj:9Or6PE+79edqj27+UBxcRqlr1BSuMj
Score10/10-
Floxif family
-
Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
-
Detects Floxif payload
-
Event Triggered Execution: AppInit DLLs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-