Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
2025-01-04_7c5690a3507490fa590e8ab2e7baed32_floxif_mafia
-
Size
2.4MB
-
Sample
250104-w33cestjgq
-
MD5
7c5690a3507490fa590e8ab2e7baed32
-
SHA1
49232eee36d844a2f3a28e3ad6ad1fcd2e8f88c6
-
SHA256
0eac6eab61253ba1da2dab3016859e01b6f9aa3b225a3fa805edc4e75cc90adc
-
SHA512
7f6e659c635faedccd35aa1d2b706e439218969d102587e74ef3d95c17e03a0adda2f4a0f53f623452eeb1c53e973b1307b2fa18576cd889267a4ce4a1e6615e
-
SSDEEP
49152:+uE7AkqIxGrGYyZa/tgrYJUGfZC3wA6EylfwEaFW31qb:JE7AfrlyutLxC3sEwwM3Ub
Malware Config
Targets
-
-
Target
2025-01-04_7c5690a3507490fa590e8ab2e7baed32_floxif_mafia
-
Size
2.4MB
-
MD5
7c5690a3507490fa590e8ab2e7baed32
-
SHA1
49232eee36d844a2f3a28e3ad6ad1fcd2e8f88c6
-
SHA256
0eac6eab61253ba1da2dab3016859e01b6f9aa3b225a3fa805edc4e75cc90adc
-
SHA512
7f6e659c635faedccd35aa1d2b706e439218969d102587e74ef3d95c17e03a0adda2f4a0f53f623452eeb1c53e973b1307b2fa18576cd889267a4ce4a1e6615e
-
SSDEEP
49152:+uE7AkqIxGrGYyZa/tgrYJUGfZC3wA6EylfwEaFW31qb:JE7AfrlyutLxC3sEwwM3Ub
Score10/10-
Floxif family
-
Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
-
Detects Floxif payload
-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Network Service Discovery
Attempt to gather information on host's network.
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-