floxif | 388e53aa02116e387bcd59bc9cd2c460d33ebe63086c9f27aa86b51696489ad0 | Triage

Submit
Reports

Overview

overview

Static

static

3

388e53aa02...d0.exe

windows7-x64

388e53aa02...d0.exe

windows10-2004-x64

3

Sharing

General

Target

388e53aa02116e387bcd59bc9cd2c460d33ebe63086c9f27aa86b51696489ad0
Size

14.1MB
Sample

250105-gf5rpstpes
MD5

4bcc12be886d135e83a392b3a067f5f2
SHA1

888f2c6a9316704ed0c81540292f81a07a1c5ddd
SHA256

388e53aa02116e387bcd59bc9cd2c460d33ebe63086c9f27aa86b51696489ad0
SHA512

0112eb31d756203440ece13cf5c89d1cd56c4b89c7038ab0f63c4f7967a43c7b69882ce43aca4b4946e63d2448bb8d0343f9f05fb8f6c5bc227a2815da4f8f3a
SSDEEP

196608:AYMYwcqvXbpFnPomUeMgigB2efrCR3acBcaTPSz33Hfr0Dz2GtNr7JwN83AgBqJm:UYd6rbnLNg3acBca2D01tNPJimiZYb

Score

10^/10

floxif backdoor defense_evasion discovery trojan upx

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

388e53aa02116e387bcd59bc9cd2c460d33ebe63086c9f27aa86b51696489ad0.exe

Resource

win7-20240903-en

floxif backdoor defense_evasion discovery trojan upx

windows7-x64

17 signatures

150 seconds

Behavioral task

behavioral2

Sample

388e53aa02116e387bcd59bc9cd2c460d33ebe63086c9f27aa86b51696489ad0.exe

Resource

win10v2004-20241007-en

windows10-2004-x64

1 signatures

150 seconds

Malware Config

Targets

- Target
  
  388e53aa02116e387bcd59bc9cd2c460d33ebe63086c9f27aa86b51696489ad0
- Size
  
  14.1MB
- MD5
  
  4bcc12be886d135e83a392b3a067f5f2
- SHA1
  
  888f2c6a9316704ed0c81540292f81a07a1c5ddd
- SHA256
  
  388e53aa02116e387bcd59bc9cd2c460d33ebe63086c9f27aa86b51696489ad0
- SHA512
  
  0112eb31d756203440ece13cf5c89d1cd56c4b89c7038ab0f63c4f7967a43c7b69882ce43aca4b4946e63d2448bb8d0343f9f05fb8f6c5bc227a2815da4f8f3a
- SSDEEP
  
  196608:AYMYwcqvXbpFnPomUeMgigB2efrCR3acBcaTPSz33Hfr0Dz2GtNr7JwN83AgBqJm:UYd6rbnLNg3acBca2D01tNPJimiZYb
Score

10^/10

floxif backdoor defense_evasion discovery trojan upx
- Floxif family
  floxif
- Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Detects Floxif payload
  backdoor
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

File Deletion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

floxifbackdoordefense_evasiondiscoverytrojanupx

behavioral2

© 2018-2025

Terms | Privacy

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.