Overview

overview

10

Static

static

1

2024-12-28...ia.exe

windows7-x64

10

2024-12-28...ia.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2024-12-28_7cdf75a683aa467119eb73bb796a2f78_floxif_mafia

  • Size

    2.5MB

  • Sample

    241228-pnt9yaxqhy

  • MD5

    7cdf75a683aa467119eb73bb796a2f78

  • SHA1

    6a34303c3b3cf6a7266ba0d8611e173acc52ec6d

  • SHA256

    a1192cd8bd5802387cf650ca41b174b5f6bd4e1e455ad51eaec86f585ac0cf36

  • SHA512

    6422848f643a588cbec6835b9a37d10c8e1de4487cd35d3e3e5a7b7cddc8a1813de6efd78f8d3e013e2000968ab0d382342fea20f3dd8002dc7f9658f0c8ca27

  • SSDEEP

    49152:1uIIKcofs2hPd2l177BTK2VbDsar1YDjs:1jZfs2hPIl1/v

Score
10/10
floxifbackdoordiscoverypersistenceprivilege_escalationtrojanupx

Malware Config

Targets

    • Target

      2024-12-28_7cdf75a683aa467119eb73bb796a2f78_floxif_mafia

    • Size

      2.5MB

    • MD5

      7cdf75a683aa467119eb73bb796a2f78

    • SHA1

      6a34303c3b3cf6a7266ba0d8611e173acc52ec6d

    • SHA256

      a1192cd8bd5802387cf650ca41b174b5f6bd4e1e455ad51eaec86f585ac0cf36

    • SHA512

      6422848f643a588cbec6835b9a37d10c8e1de4487cd35d3e3e5a7b7cddc8a1813de6efd78f8d3e013e2000968ab0d382342fea20f3dd8002dc7f9658f0c8ca27

    • SSDEEP

      49152:1uIIKcofs2hPd2l177BTK2VbDsar1YDjs:1jZfs2hPIl1/v

    Score
    10/10
    floxifbackdoordiscoverypersistenceprivilege_escalationtrojanupx

    • Floxif family

      floxif

    • Floxif, Floodfix

      Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.

      backdoortrojanfloxif

    • Detects Floxif payload

      backdoor

    • Event Triggered Execution: AppInit DLLs

      Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

      persistenceprivilege_escalation

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks