General
-
Target
7b1d1317dc53d410b3b8c7f09e3affa4cd7ebbfae80c89a3147752c461503e7b
-
Size
295KB
-
Sample
241230-aq3a1a1qct
-
MD5
20fecfdda605a23d8236b0d515156c89
-
SHA1
b47402b373a3c7ff0a96dbf42f498d12448a840d
-
SHA256
7b1d1317dc53d410b3b8c7f09e3affa4cd7ebbfae80c89a3147752c461503e7b
-
SHA512
02625a91892b839f7d859b9952334acf37cce18789743abbabf9f706f6432d2d787240658080cf0ba2cd708e524c9513028cc018c309875074638bbf9795ef99
-
SSDEEP
6144:5BYvHkL6agJ2uMYKNUhJ5E5wW+u3BV+UdvrEFp7hK1o:5mvkL61J2uyiJ5E5Ou3BjvrEH7Wo
Malware Config
Targets
-
-
Target
7b1d1317dc53d410b3b8c7f09e3affa4cd7ebbfae80c89a3147752c461503e7b
-
Size
295KB
-
MD5
20fecfdda605a23d8236b0d515156c89
-
SHA1
b47402b373a3c7ff0a96dbf42f498d12448a840d
-
SHA256
7b1d1317dc53d410b3b8c7f09e3affa4cd7ebbfae80c89a3147752c461503e7b
-
SHA512
02625a91892b839f7d859b9952334acf37cce18789743abbabf9f706f6432d2d787240658080cf0ba2cd708e524c9513028cc018c309875074638bbf9795ef99
-
SSDEEP
6144:5BYvHkL6agJ2uMYKNUhJ5E5wW+u3BV+UdvrEFp7hK1o:5mvkL61J2uyiJ5E5Ou3BjvrEH7Wo
Score10/10-
Floxif family
-
Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
-
Detects Floxif payload
-
Downloads MZ/PE file
-
Event Triggered Execution: AppInit DLLs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
Executes dropped EXE
-
Loads dropped DLL
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-