floxif | 55cef38a8d8916410a07bd93cdf2b868b66bc5e6e38076c565d2a74f6070f367

General

Target

2025-01-08_938d5e9e8b5b7b69b6b0ced1fc12142f_floxif_magniber
Size

1.8MB
Sample

250108-jttbyatkam
MD5

938d5e9e8b5b7b69b6b0ced1fc12142f
SHA1

05a9884b0295f3ab95c8fe00fb5962b563d43f16
SHA256

55cef38a8d8916410a07bd93cdf2b868b66bc5e6e38076c565d2a74f6070f367
SHA512

25cf9eba3c87565faf53175d29f5c7712e1bb39ef72981972701ad7b19ab50faf167b50ea80e36c0e0af84ac52086d2dfce536505606360ee66b98c7e0326efa
SSDEEP

24576:rqyoppMC3e8Cb30zKiKYl+jX+Bk5N9ndZlW0Uc04KzThfuvG51rI2R3VroatPg3a:znbkzSYl+aFUUhf3LI43VEarMlyt

Score

10^/10

Malware Config

Targets

- Target
  
  2025-01-08_938d5e9e8b5b7b69b6b0ced1fc12142f_floxif_magniber
- Size
  
  1.8MB
- MD5
  
  938d5e9e8b5b7b69b6b0ced1fc12142f
- SHA1
  
  05a9884b0295f3ab95c8fe00fb5962b563d43f16
- SHA256
  
  55cef38a8d8916410a07bd93cdf2b868b66bc5e6e38076c565d2a74f6070f367
- SHA512
  
  25cf9eba3c87565faf53175d29f5c7712e1bb39ef72981972701ad7b19ab50faf167b50ea80e36c0e0af84ac52086d2dfce536505606360ee66b98c7e0326efa
- SSDEEP
  
  24576:rqyoppMC3e8Cb30zKiKYl+jX+Bk5N9ndZlW0Uc04KzThfuvG51rI2R3VroatPg3a:znbkzSYl+aFUUhf3LI43VEarMlyt
Score

10^/10

floxif backdoor bootkit discovery persistence privilege_escalation trojan upx
- Floxif family
  floxif
- Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Detects Floxif payload
  backdoor
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2