General

  • Target

    2025-01-02_cf1a96e3b241fda0a583c110caccf039_floxif_mafia

  • Size

    2.6MB

  • Sample

    250102-pmpm3a1rgv

  • MD5

    cf1a96e3b241fda0a583c110caccf039

  • SHA1

    98737a4c76bb0434785e540ea236d3a96e194e17

  • SHA256

    3302acdc8c2b2a27d627d9d8ac1aac0bbbae6717d994168f4538e12cb4f2b7eb

  • SHA512

    c8fcd3541aa970397e7ba681fb0ed7828ebb0ca8a642448106fa06c54050c8da0c3cf379abd3b759f348e807e0ec726ea4fffd6dca7a1dfe65af2f520854bba9

  • SSDEEP

    49152:gxLv4ViQaiDxb2BNvHVU8PTnUF5cGQ3GM0xwXYjW6dS8yTYITLP+jviDfSaPs:gx8iFib2BNvLPTn+5cGQ3GM0LWyyTYIO

Malware Config

Targets

    • Target

      2025-01-02_cf1a96e3b241fda0a583c110caccf039_floxif_mafia

    • Size

      2.6MB

    • MD5

      cf1a96e3b241fda0a583c110caccf039

    • SHA1

      98737a4c76bb0434785e540ea236d3a96e194e17

    • SHA256

      3302acdc8c2b2a27d627d9d8ac1aac0bbbae6717d994168f4538e12cb4f2b7eb

    • SHA512

      c8fcd3541aa970397e7ba681fb0ed7828ebb0ca8a642448106fa06c54050c8da0c3cf379abd3b759f348e807e0ec726ea4fffd6dca7a1dfe65af2f520854bba9

    • SSDEEP

      49152:gxLv4ViQaiDxb2BNvHVU8PTnUF5cGQ3GM0xwXYjW6dS8yTYITLP+jviDfSaPs:gx8iFib2BNvLPTn+5cGQ3GM0LWyyTYIO

    • Floxif family

    • Floxif, Floodfix

      Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.

    • Detects Floxif payload

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks