Overview

overview

10

Static

static

3

40dfeab1ef...62.exe

windows7-x64

10

40dfeab1ef...62.exe

windows10-2004-x64

10

$PLUGINSDI...fo.dll

windows7-x64

3

$PLUGINSDI...fo.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...os.dll

windows7-x64

3

$PLUGINSDI...os.dll

windows10-2004-x64

3

$PLUGINSDI...sh.dll

windows7-x64

3

$PLUGINSDI...sh.dll

windows10-2004-x64

3

$PLUGINSDI...ce.dll

windows7-x64

3

$PLUGINSDI...ce.dll

windows10-2004-x64

3

$PLUGINSDI...ec.dll

windows7-x64

3

$PLUGINSDI...ec.dll

windows10-2004-x64

3

$PLUGINSDI...ry.dll

windows7-x64

3

$PLUGINSDI...ry.dll

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    40dfeab1ef80f94a4d5494a837904ecfbdaa19053d3a6a8dabb2ea1345cf0462

  • Size

    272KB

  • Sample

    250107-25cgnsvncq

  • MD5

    05a125db7da5bf40f0dcded4c8184f6e

  • SHA1

    c87bee0861168ac71fe9a7ca298ea61f1c2a4110

  • SHA256

    40dfeab1ef80f94a4d5494a837904ecfbdaa19053d3a6a8dabb2ea1345cf0462

  • SHA512

    b6a0107fe9dbe7296968abe365272091c9fa8594dfce1edcbe656f324a6b2c3b12aee22b5b0b9155dfa57b12402ba588117b3aaaf20f10deea3a41b2ccf29c8c

  • SSDEEP

    6144:D/EUXmEc8tZFGxuNhIB7UA9hQGQ2fy1BV+UdvrEFp7hKTt1Dp:D/E7oHXNhIB7H9hQGQ2K1BjvrEH7onp

Score
10/10
floxifbackdoordiscoverypersistenceprivilege_escalationtrojanupx

Malware Config

Targets

    • Target

      40dfeab1ef80f94a4d5494a837904ecfbdaa19053d3a6a8dabb2ea1345cf0462

    • Size

      272KB

    • MD5

      05a125db7da5bf40f0dcded4c8184f6e

    • SHA1

      c87bee0861168ac71fe9a7ca298ea61f1c2a4110

    • SHA256

      40dfeab1ef80f94a4d5494a837904ecfbdaa19053d3a6a8dabb2ea1345cf0462

    • SHA512

      b6a0107fe9dbe7296968abe365272091c9fa8594dfce1edcbe656f324a6b2c3b12aee22b5b0b9155dfa57b12402ba588117b3aaaf20f10deea3a41b2ccf29c8c

    • SSDEEP

      6144:D/EUXmEc8tZFGxuNhIB7UA9hQGQ2fy1BV+UdvrEFp7hKTt1Dp:D/E7oHXNhIB7H9hQGQ2K1BjvrEH7onp

    Score
    10/10
    floxifbackdoordiscoverypersistenceprivilege_escalationtrojanupx

    • Floxif family

      floxif

    • Floxif, Floodfix

      Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.

      backdoortrojanfloxif

    • Detects Floxif payload

      backdoor

    • Event Triggered Execution: AppInit DLLs

      Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

      persistenceprivilege_escalation

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

    • Target

      $PLUGINSDIR/MoreInfo.dll

    • Size

      7KB

    • MD5

      bd393029cc49b415b6c9aeb8a4936516

    • SHA1

      c67fd92fffd18941bed41bfd6ac4f3b04fd123df

    • SHA256

      227a4fc9408a44faa5eca608a974bd536814f97b8a4d28b4cac479727167b026

    • SHA512

      3bb8e5cf4bea7e8adaa62196e58fff9031f49fd4efa78e5bd3e4b9c4e9ba1523864567521793053595d90abec719761a5964ff3abe04b93b24d52e5ffa4c1f96

    • SSDEEP

      96:LEjAlUFPxXJugoImuaKbkBSEPTpsxKaVQ4Ad:gjAiFPxXJugoImJKQk8yxKaVVe

    Score
    3/10
    discovery
    behavioral3behavioral4

    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      bf712f32249029466fa86756f5546950

    • SHA1

      75ac4dc4808ac148ddd78f6b89a51afbd4091c2e

    • SHA256

      7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af

    • SHA512

      13f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4

    • SSDEEP

      192:0N2gQuUwXzioj4KALV2upWzVd7q1QDXEbBZ8KxHdGzyS/Kx:rJoiO8V2upW7vQjS/

    Score
    3/10
    discovery
    behavioral5behavioral6

    • Target

      $PLUGINSDIR/execDos.dll

    • Size

      5KB

    • MD5

      0deb397ca1e716bb7b15e1754e52b2ac

    • SHA1

      fbb9bcf872c5dbb4ca4c80fb21d41519bc273ef5

    • SHA256

      720be35cd1b4a333264713dc146b4ad024f3a7ad0644c2d8c6fcedd3c30e8a1f

    • SHA512

      507db0bee0897660750007e7ce674406acf9e8bf942cf26ded5654c07682757b07c9eb767bead0966478abc554dc9a6461c4288dc35d12cacfadad4c128f1bb7

    • SSDEEP

      96:J++xDiP4p7t7dNOt3stxtRFFXxGD6qxlnKE6ttdH3r3:Rx9pJ7jQs5toD6Cln/6tt1

    Score
    3/10
    discovery
    behavioral7behavioral8

    • Target

      $PLUGINSDIR/newadvsplash.dll

    • Size

      8KB

    • MD5

      55a723e125afbc9b3a41d46f41749068

    • SHA1

      01618b26fec6b8c6bdb866e6e4d0f7a0529fe97c

    • SHA256

      0a70cc4b93d87ecd93e538cfbed7c9a4b8b5c6f1042c6069757bda0d1279ed06

    • SHA512

      559157fa1b3eb6ae1f9c0f2c71ccc692a0a0affb1d6498a8b8db1436d236fd91891897ac620ed5a588beba2efa43ef064211a7fcadb5c3a3c5e2be1d23ef9d4c

    • SSDEEP

      96:/VV0Rwtvrm2nQujIvP9dir3UniV/zRzVR3rN3k8Jd18tsPcaqhx:/VV0KtC2yH9d83BzVR53kEQFaq

    Score
    3/10
    discovery
    behavioral10behavioral9

    • Target

      $PLUGINSDIR/newtextreplace.dll

    • Size

      11KB

    • MD5

      b5358341df2cb171876a5f201e31a834

    • SHA1

      df34750ea5504274be5ff8ddd306b49e302d04f9

    • SHA256

      156b9b583399faf13c4d46b89339fb0f7f38dc847ac2d7872178d8e3998b9734

    • SHA512

      821dc42e24fa2d44a1d4d16b26c3da2688dac0fa44a266e38da2aff706c91440d83a87abc74131930e6c38a44a0c5e627db2d045375fde147e0edd3276f4b014

    • SSDEEP

      192:GGhRfigbU26niqo9m+9k15AA1NrW0QfaDx3nxNLr6s+:GIwgSnhv/IaDx3n6X

    Score
    3/10
    discovery
    behavioral11behavioral12

    • Target

      $PLUGINSDIR/nsExec.dll

    • Size

      6KB

    • MD5

      132e6153717a7f9710dcea4536f364cd

    • SHA1

      e39bc82c7602e6dd0797115c2bd12e872a5fb2ab

    • SHA256

      d29afce2588d8dd7bb94c00ca91cac0e85b80ffa6b221f5ffcb83a2497228eb2

    • SHA512

      9aeb0b3051ce07fb9f03dfee7cea4a5e423425e48cb538173bd2a167817f867a30bd4d27d07875f27ca00031745b24547030b7f146660b049fa717590f1c77e1

    • SSDEEP

      96:M/SspqrIYxLPEQhThvov3TE4/2Sa5P9QFFYzOx4uF3sbSEI5LP39sQvM:M/QUG7lhvov36S5FcUjliSEI5LuQ

    Score
    3/10
    discovery
    behavioral13behavioral14

    • Target

      $PLUGINSDIR/registry.dll

    • Size

      24KB

    • MD5

      2b7007ed0262ca02ef69d8990815cbeb

    • SHA1

      2eabe4f755213666dbbbde024a5235ddde02b47f

    • SHA256

      0b25b20f26de5d5bd795f934c70447112b4981343fcb2dfab3374a4018d28c2d

    • SHA512

      aa75ee59ca0b8530eb7298b74e5f334ae9d14129f603b285a3170b82103cfdcc175af8185317e6207142517769e69a24b34fcdf0f58ed50a4960cbe8c22a0aca

    • SSDEEP

      384:W2mvyNjH3rPnAZ4wu2QbnC7qB7PnrvScaeYA4CIDEge/QqL2AQ:/75w/OfrzB4CUxuQfA

    Score
    3/10
    discovery
    behavioral15behavioral16

MITRE ATT&CK Enterprise v15

Tasks