floxif | 293fac3cfccd066eefe05554679ffdc2b15d7e1bd14d6287076d6d8830437195 | Triage

Submit
Reports

Overview

overview

Static

static

3

293fac3cfc...5N.exe

windows7-x64

293fac3cfc...5N.exe

windows10-2004-x64

Sharing

General

Target

293fac3cfccd066eefe05554679ffdc2b15d7e1bd14d6287076d6d8830437195N.exe
Size

269KB
Sample

241231-daz3gszqfl
MD5

ed6c46e29d19fe16ede885f1e4e2f330
SHA1

231c2efeda93e845d4e6f81841df7002086b47fe
SHA256

293fac3cfccd066eefe05554679ffdc2b15d7e1bd14d6287076d6d8830437195
SHA512

ddcc7e7dd6fc93fbaeedf7673a29d28780073dc5dcab9399541405352a4ba95e1ea1ff839c6927a34ac90c46bf825c934c6f4951559c1f90bb2081a4f0713523
SSDEEP

6144:UkLqdufoPDamz1pLBV+UdvrEFp7hKECUxr:r4PDa6BjvrEH7f7r

Score

10^/10

floxif backdoor discovery evasion persistence trojan upx

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

293fac3cfccd066eefe05554679ffdc2b15d7e1bd14d6287076d6d8830437195N.exe

Resource

win7-20240708-en

floxif backdoor discovery evasion persistence trojan upx

windows7-x64

19 signatures

120 seconds

Behavioral task

behavioral2

Sample

293fac3cfccd066eefe05554679ffdc2b15d7e1bd14d6287076d6d8830437195N.exe

Resource

win10v2004-20241007-en

floxif backdoor discovery evasion persistence trojan upx

windows10-2004-x64

19 signatures

120 seconds

Malware Config

Targets

- Target
  
  293fac3cfccd066eefe05554679ffdc2b15d7e1bd14d6287076d6d8830437195N.exe
- Size
  
  269KB
- MD5
  
  ed6c46e29d19fe16ede885f1e4e2f330
- SHA1
  
  231c2efeda93e845d4e6f81841df7002086b47fe
- SHA256
  
  293fac3cfccd066eefe05554679ffdc2b15d7e1bd14d6287076d6d8830437195
- SHA512
  
  ddcc7e7dd6fc93fbaeedf7673a29d28780073dc5dcab9399541405352a4ba95e1ea1ff839c6927a34ac90c46bf825c934c6f4951559c1f90bb2081a4f0713523
- SSDEEP
  
  6144:UkLqdufoPDamz1pLBV+UdvrEFp7hKECUxr:r4PDa6BjvrEH7f7r
Score

10^/10

floxif backdoor discovery evasion persistence trojan upx
- Floxif family
  floxif
- Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Detects Floxif payload
  backdoor
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Scheduled Task

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Scheduled Task

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

floxifbackdoordiscoveryevasionpersistencetrojanupx

behavioral2

floxifbackdoordiscoveryevasionpersistencetrojanupx

© 2018-2025

Terms | Privacy