floxif | 163465920fd1a8d28e92b7144be15c67e2d299e7cfe3c188525ab57192845c08

General

Target

163465920fd1a8d28e92b7144be15c67e2d299e7cfe3c188525ab57192845c08
Size

2.5MB
Sample

250108-zb5j9avlfm
MD5

ef1a6b20bcca4e835952577c6a6a01d6
SHA1

76e95366357f0de070bb29a68869c0f58d7bc33a
SHA256

163465920fd1a8d28e92b7144be15c67e2d299e7cfe3c188525ab57192845c08
SHA512

ea324651087821bc93f187316795156a0a84cd470051a9276db1a6fe64435202c226da27f0cc115719eca990bf505ee7abbc3300e600ecc70b0e43c313eb08e0
SSDEEP

49152:D5ChFIsxUbi++Ze9hDrXpkoam/b6XDI5l8WRv+be1naxRsgt6eqnyjCy:D52FIs2Ie9hnXGoamD6X3WJ7sjsU6S+y

Score

10^/10

Malware Config

Targets

- Target
  
  163465920fd1a8d28e92b7144be15c67e2d299e7cfe3c188525ab57192845c08
- Size
  
  2.5MB
- MD5
  
  ef1a6b20bcca4e835952577c6a6a01d6
- SHA1
  
  76e95366357f0de070bb29a68869c0f58d7bc33a
- SHA256
  
  163465920fd1a8d28e92b7144be15c67e2d299e7cfe3c188525ab57192845c08
- SHA512
  
  ea324651087821bc93f187316795156a0a84cd470051a9276db1a6fe64435202c226da27f0cc115719eca990bf505ee7abbc3300e600ecc70b0e43c313eb08e0
- SSDEEP
  
  49152:D5ChFIsxUbi++Ze9hDrXpkoam/b6XDI5l8WRv+be1naxRsgt6eqnyjCy:D52FIs2Ie9hnXGoamD6X3WJ7sjsU6S+y
Score

10^/10

floxif backdoor discovery trojan upx
- Floxif family
  floxif
- Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Detects Floxif payload
  backdoor
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Floxif family

Floxif, Floodfix

Detects Floxif payload

ACProtect 1.3x - 1.4x DLL software

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

UPX packed file

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2