Overview

overview

10

Static

static

3

3fbdb427bc...4N.exe

windows7-x64

10

3fbdb427bc...4N.exe

windows10-2004-x64

10

$PLUGINSDI...os.dll

windows7-x64

3

$PLUGINSDI...os.dll

windows10-2004-x64

3

$PLUGINSDI...LL.dll

windows7-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...sh.dll

windows7-x64

3

$PLUGINSDI...sh.dll

windows10-2004-x64

3

$PLUGINSDI...ry.dll

windows7-x64

3

$PLUGINSDI...ry.dll

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3fbdb427bcfd6a652245f00c559290255761bf0c4285a8cb6f0c58483a01cb74N.exe

  • Size

    236KB

  • Sample

    250104-ztzfysxkey

  • MD5

    5850c699de34c4d592649db4912cb7a0

  • SHA1

    bd8ef397bcb596e719e362c83e713634733e63a8

  • SHA256

    3fbdb427bcfd6a652245f00c559290255761bf0c4285a8cb6f0c58483a01cb74

  • SHA512

    b2c97e07c005a74a38bf38aac181f01e98139d1b97158d8421a95bdccb80a5dffefccf5dfa0c550c97c3a1ca2c671b22b80ae719c68af5df42ae832f73b3797b

  • SSDEEP

    3072:qduSGUSQcfBmmVeHu08rgSopmeZczUZG0lUY32lQBV+UdE+rECWp7hK4panq1:qiL3VvumgcQ4yBV+UdvrEFp7hKSd1

Score
10/10
floxifbackdoordiscoverypersistenceprivilege_escalationtrojanupx

Malware Config

Targets

    • Target

      3fbdb427bcfd6a652245f00c559290255761bf0c4285a8cb6f0c58483a01cb74N.exe

    • Size

      236KB

    • MD5

      5850c699de34c4d592649db4912cb7a0

    • SHA1

      bd8ef397bcb596e719e362c83e713634733e63a8

    • SHA256

      3fbdb427bcfd6a652245f00c559290255761bf0c4285a8cb6f0c58483a01cb74

    • SHA512

      b2c97e07c005a74a38bf38aac181f01e98139d1b97158d8421a95bdccb80a5dffefccf5dfa0c550c97c3a1ca2c671b22b80ae719c68af5df42ae832f73b3797b

    • SSDEEP

      3072:qduSGUSQcfBmmVeHu08rgSopmeZczUZG0lUY32lQBV+UdE+rECWp7hK4panq1:qiL3VvumgcQ4yBV+UdvrEFp7hKSd1

    Score
    10/10
    floxifbackdoordiscoverytrojanupxpersistenceprivilege_escalation

    • Floxif family

      floxif

    • Floxif, Floodfix

      Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.

      backdoortrojanfloxif

    • Detects Floxif payload

      backdoor

    • Event Triggered Execution: AppInit DLLs

      Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

      persistenceprivilege_escalation

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

    • Target

      $PLUGINSDIR/ExecDos.dll

    • Size

      5KB

    • MD5

      a7cd6206240484c8436c66afb12bdfbf

    • SHA1

      0bb3e24a7eb0a9e5a8eae06b1c6e7551a7ec9919

    • SHA256

      69ac56d2fdf3c71b766d3cc49b33b36f1287cc2503310811017467dfcb455926

    • SHA512

      b9ee7803301e50a8ec20ab3f87eb9e509ea24d11a69e90005f30c1666acc4ed0a208bd56e372e2e5c6a6d901d45f04a12427303d74761983593d10b344c79904

    • SSDEEP

      48:6jOBtU/BXN8kUByyy/Aklkcrkyg7Vg5RibGoTCTo0gqVeeaeQqzM5rv774YRljmB:y/DMy4ncrkyg7tbpQFLUEYRxe

    Score
    3/10
    discovery
    behavioral3behavioral4

    • Target

      $PLUGINSDIR/FindProcDLL.dll

    • Size

      4KB

    • MD5

      ca3471f7ceaeeebdb49f902e2254d9c2

    • SHA1

      d2392d3856225b7008fc00c3bed900cc1c271931

    • SHA256

      4aeb2f68a14654077a21108eb97f6abc590262140acde0108965c6a1e0b18af8

    • SHA512

      b547bc60404b43e793f354dc76837d5e13d8252f3fbaf7a0f84a1fdf027fcaa9c9be35ff44f28836fed1d59c0e4a69a32ac9482f693a450d24f563171b3433d7

    Score
    3/10
    discovery
    behavioral5behavioral6

    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      55a26d7800446f1373056064c64c3ce8

    • SHA1

      80256857e9a0a9c8897923b717f3435295a76002

    • SHA256

      904fd5481d72f4e03b01a455f848dedd095d0fb17e33608e0d849f5196fb6ff8

    • SHA512

      04b8ab7a85c26f188c0a06f524488d6f2ac2884bf107c860c82e94ae12c3859f825133d78338fd2b594dfc48f7dc9888ae76fee786c6252a5c77c88755128a5b

    • SSDEEP

      192:MPtkumJX7zBE2kGwfy9S9VkPsFQ1Mx1c:97O2k5q9wA1Mxa

    Score
    3/10
    discovery
    behavioral7behavioral8

    • Target

      $PLUGINSDIR/newadvsplash.dll

    • Size

      8KB

    • MD5

      9bc6c411efa742a5de7d8372afafa2fa

    • SHA1

      2b57865e87c7ca2db97d0296d8cbe0183df2c2cf

    • SHA256

      0cac914c87d4e73875dea8544391e383f441d624ea5ec9a4864d056db161206c

    • SHA512

      092ef3f13a71a46df0f78a3b5eb4492bee32f1a12be27e0c534638ec7723b2a9aac23391768c352289df6a8988cbc6cf96ea22d8f1983b5ccf609e08d1db4bde

    • SSDEEP

      192:7p/MyET9lrRyFJb9kSw/T6rz91YrLV1hiI:7p/MyET90k7/T6rB1Yk

    Score
    3/10
    discovery
    behavioral10behavioral9

    • Target

      $PLUGINSDIR/registry.dll

    • Size

      16KB

    • MD5

      351f89337642c165a48dd763aa210023

    • SHA1

      a5b204cbc51a0ad84248aa680b85be7824f3354e

    • SHA256

      b610ab13da00e05b000026c73081cfdf0d2ebd3f2fad05e1d0f277060fc3c07f

    • SHA512

      10326b95ea81b377f74cb9e42135e891930a354b65ce50a4562246da33ca6816f5397089bb60cd1eb647bd28829d70f6425c3113440e11f9a9a4f7fecaac7f4c

    • SSDEEP

      384:tTVUUuJHxgeh2OTU+X9pCtlohiTV0pWY7:tTqzHxgeh5X9oaiTgW

    Score
    3/10
    discovery
    behavioral11behavioral12

MITRE ATT&CK Enterprise v15

Tasks