Analysis
-
max time kernel
146s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
09-01-2025 00:49
General
-
Target
2025-01-09_9abd6f886a2d1ba354fd0f1ada231f4f_floxif_mafia.exe
-
Size
2.4MB
-
MD5
9abd6f886a2d1ba354fd0f1ada231f4f
-
SHA1
5047888d361fa4e722cce6c2ae9a0e4b22285226
-
SHA256
bc5b146a3d794ca25a48e402b20f8d44f401900d00aa2de2e523e839614066c9
-
SHA512
2572d6160ec38bbfb2b31f07bf1b1281a383ef87aa4f3dc6e3495077a64aac16e8ff5fd53a0e2d7f67c0433df1f224b033b47497aedc5725db231f405257d3a4
-
SSDEEP
49152:21uE7AxqIxGrGYyZa/tgrYJUGfZC3wA6EylfwEaFW31qP:ZE7AErlyutLxC3sEwwM3UP
Malware Config
Signatures
-
Floxif family
-
Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
-
Detects Floxif payload 1 IoCs
-
Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 25 IoCs
-
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Network Service Discovery 1 TTPs 9 IoCs
Attempt to gather information on host's network.
-
Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
UPX packed file 31 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Program Files directory 49 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 13 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
NSIS installer 2 IoCs
-
Modifies system certificate store 2 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 51 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-01-09_9abd6f886a2d1ba354fd0f1ada231f4f_floxif_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2025-01-09_9abd6f886a2d1ba354fd0f1ada231f4f_floxif_mafia.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\arp.exearp -a2⤵
- Loads dropped DLL
- Network Service Discovery
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\arp.exearp -s 10.127.0.1 e9-25-ce-ae-ba-c52⤵
- Loads dropped DLL
- Network Service Discovery
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\arp.exearp -s 10.127.255.255 c8-6c-11-bd-c1-742⤵
- Loads dropped DLL
- Network Service Discovery
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\arp.exearp -s 49.12.169.208 ba-30-1a-c8-d1-1d2⤵
- Loads dropped DLL
- Network Service Discovery
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\arp.exearp -s 224.0.0.22 6a-2c-b1-6f-6a-e82⤵
- Loads dropped DLL
- Network Service Discovery
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\arp.exearp -s 224.0.0.251 21-12-8e-06-94-542⤵
- Loads dropped DLL
- Network Service Discovery
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\arp.exearp -s 224.0.0.252 3e-eb-13-83-12-532⤵
- Loads dropped DLL
- Network Service Discovery
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\arp.exearp -s 239.255.255.250 bc-ba-e9-76-8d-622⤵
- Loads dropped DLL
- Network Service Discovery
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\arp.exearp -s 255.255.255.255 b8-d3-b9-9e-3c-822⤵
- Loads dropped DLL
- Network Service Discovery
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\minidownload.exe"C:\Users\Admin\AppData\Local\Temp\minidownload.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files (x86)\SogouSoftware\SogouSoftware.exe"C:\Program Files (x86)\SogouSoftware\SogouSoftware.exe" /Loader /DownLoad?status=true&softurl=https%3A%2F%2Fxiazai.sogou.com%2Fcomm%2Fredir%3Fsoftdown%3D1%26u%3DG30HdQ8G4ngDpbEHfW1gEXYhwD6lzpDc8HlTAHx7scbrxDthotkHK0HexvlOWvJbJd76eqnPU0MQPeaLH3gS2w..%26pcid%3D-2241203717467645359%26fr%3Dxiazai%26source%3Dxixi%26filename%3Dpdfwjt.zip&iconurl=https%3A%2F%2Fpic.cr173.com%2Fup%2F2014-4%2F201449152326.jpg&softname=PDF%E8%BD%AC%E6%8D%A2%E9%80%9A&softsize=19.05MB2⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\arp.exearp -d2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Event Triggered Execution
1AppInit DLLs
1Pre-OS Boot
1Bootkit
1Defense Evasion
Modify Registry
1Pre-OS Boot
1Bootkit
1Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
232KB
MD50bc2d003fcfe3fa65f4c3ba7a015fa41
SHA172ed85bc1c57259b4f2ed36d16ce3fed4e30607c
SHA256388069590fb9569b6c498f941d0565416cb52fc803648ee21b8c59917c63eb4b
SHA512ae8d83e6ca21ee9b0d5e5845fac3a4dc01c6038243da36b4360b2f42763478265cdafc89072c47672b9738de1930e5e5191e2bf91715055cbd16a949d313ff24
-
Filesize
53B
MD5113136892f2137aa0116093a524ade0b
SHA1a0284943f8ddfe69ceec90833e66d96bdf4a97f0
SHA256ebbf7e8800c3446bc3a195fa53573bde1073b0bf7581a614372f1391a9286d02
SHA512d3201cc19ae702a9813aa8bc39612ebaa48138903e9ede64dcadff213691f6e711876aa4fa083887c545325d5d8bf70649523c528090542459f2b01697180e99
-
Filesize
342B
MD505d5b98feaf7a3a88793d61834fe5823
SHA16bcd9f7b75b928ac8d2899271287a432a517072a
SHA256644833506e171b5c8a15aa50deea9079dca67ead6292822a34b48346c8b00f85
SHA512d7b663d42df36e5297b541c9ff755767e6866989d847838e43f279ebcf9991c71089e5567a58653d03b139bcd8959098303163f76e9b8ae27fadc1dd17f8413d
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
1.9MB
MD50618e9851ea4a522abeded8d40c2f19e
SHA1c6772967fdf545e32d28f3b46e97aec5b9ff99f5
SHA256506c374fbdf14420306e2da8d123c2138c2ceabd2046178317508a25949d3dc4
SHA512b8c4816d81aa14646a3b690da76c0d33f59b7d419305638747503dba6bb84a63b906fe7d0ced59850ad25db37c1e0e6f3bd614a902f2f5ffb3d2bf74ec4e571f
-
Filesize
96B
MD54443b169c992dddf140e108afdbf9b9d
SHA19af00457b95dbc1c1a9735e1ba5558b0b1f64a9e
SHA256fe34f70e18fbb00c49dc2a80936e44115d637d201ce80c5ed27067b95c545965
SHA512584e70eeeef2d98075e5683fb59891d31895d6b3138a93aa635ef3f5eb13d3a91a48a035dde71d7e666427b8df5729eb6ba15ec70c80cfb3f1720dd309a9dbe7
-
Filesize
450KB
MD5b1ce2dba9515e144908aa34ac77f5a46
SHA10a3e601eeba273a16d815c5e59793eb73db9daad
SHA2565a7349e46f16ec394af8575b666c132c010bacaa2c59da472b842ffeccc5623f
SHA512d0a78b5de9126b8126b531fb8f72ae375aac898930dccd8a61f173c28470895daab56b368c34a5925020dfdc642785651445967904d8756bb1ce7c1d2f95525a
-
Filesize
110KB
MD55d4a135fedd49b7ab79cf2c2d8e2d611
SHA14f838f694da6f598d81f71751fb1ba70e6dcffa2
SHA2561624c019d1f2befa579420a71649b352cae80afa1e43409e9ad5bf2a5ab0dd7a
SHA512a83d95f4fabb69238c5f84bffa9421003226d9c6b75f632c04a3a282a0966cb8ef4363bf18d42ef65980f306e0bf47b762e0f2f412106da204940f215f52efd7
-
Filesize
58KB
MD558bb62e88687791ad2ea5d8d6e3fe18b
SHA10ffb029064741d10c9cf3f629202aa97167883de
SHA256f02fa7ddab2593492b9b68e3f485e59eb755380a9235f6269705f6d219dff100
SHA512cd36b28f87be9cf718f0c44bf7c500d53186edc08889bcfa5222041ff31c5cbee509b186004480efbd99c36b2233182ae0969447f4051510e1771a73ed209da5
-
Filesize
262KB
MD5e2e9483568dc53f68be0b80c34fe27fb
SHA18919397fcc5ce4f91fe0dc4e6f55cea5d39e4bb9
SHA256205c40f2733ba3e30cc538adc6ac6ee46f4c84a245337a36108095b9280abb37
SHA512b6810288e5f9ad49dcbf13bf339eb775c52e1634cfa243535ab46fda97f5a2aac112549d21e2c30a95306a57363819be8ad5efd4525e27b6c446c17c9c587e4e
-
Filesize
71KB
MD5f0372ff8a6148498b19e04203dbb9e69
SHA127fe4b5f8cb9464ab5ddc63e69c3c180b77dbde8
SHA256298d334b630c77b70e66cf5e9c1924c7f0d498b02c2397e92e2d9efdff2e1bdf
SHA51265d84817cdddb808b6e0ab964a4b41e96f7ce129e3cc8c253a31642efe73a9b7070638c22c659033e1479322aceea49d1afdceff54f8ed044b1513bffd33f865
-
Filesize
87KB
MD579cb6457c81ada9eb7f2087ce799aaa7
SHA1322ddde439d9254182f5945be8d97e9d897561ae
SHA256a68e1297fae2bcf854b47ffa444f490353028de1fa2ca713b6cf6cc5aa22b88a
SHA512eca4b91109d105b2ce8c40710b8e3309c4cc944194843b7930e06daf3d1df6ae85c1b7063036c7e5cd10276e5e5535b33e49930adbad88166228316283d011b8
-
Filesize
89KB
MD5dba9a19752b52943a0850a7e19ac600a
SHA13485ac30cd7340eccb0457bca37cf4a6dfda583d
SHA25669a5e2a51094dc8f30788d63243b12a0eb2759a3f3c3a159b85fd422fc00ac26
SHA512a42c1ec5594c6f6cae10524cdad1f9da2bdc407f46e685e56107de781b9bce8210a8cd1a53edacd61365d37a1c7ceba3b0891343cf2c31d258681e3bf85049d3
-
Filesize
3.4MB
MD51a87ff238df9ea26e76b56f34e18402c
SHA12df48c31f3b3adb118f6472b5a2dc3081b302d7c
SHA256abaeb5121548256577ddd8b0fc30c9ff3790649ad6a0704e4e30d62e70a72964
SHA512b2e63aba8c081d3d38bd9633a1313f97b586b69ae0301d3b32b889690327a575b55097f19cc87c6e6ed345f1b4439d28f981fdb094e6a095018a10921dae80d9
-
Filesize
492KB
MD5a94dc60a90efd7a35c36d971e3ee7470
SHA1f936f612bc779e4ba067f77514b68c329180a380
SHA2566c483cbe349863c7dcf6f8cb7334e7d28c299e7d5aa063297ea2f62352f6bdd9
SHA512ff6c41d56337cac074582002d60cbc57263a31480c67ee8999bc02fc473b331eefed93ee938718d297877cf48471c7512741b4aebc0636afc78991cdf6eddfab
-
Filesize
340KB
MD5ca2f560921b7b8be1cf555a5a18d54c3
SHA1432dbcf54b6f1142058b413a9d52668a2bde011d
SHA256c4d4339df314a27ff75a38967b7569d9962337b8d4cd4b0db3aba5ff72b2bfbb
SHA51223e0bdd9458a5a8e0f9bbcb7f6ce4f87fcc9e47c1ee15f964c17ff9fe8d0f82dd3a0f90263daaf1ee87fad4a238aa0ee92a16b3e2c67f47c84d575768edba43e
-
Filesize
58KB
MD589f6488524eaa3e5a66c5f34f3b92405
SHA1330f9f6da03ae96dfa77dd92aae9a294ead9c7f7
SHA256bd29d2b1f930e4b660adf71606d1b9634188b7160a704a8d140cadafb46e1e56
SHA512cfe72872c89c055d59d4de07a3a14cd84a7e0a12f166e018748b9674045b694793b6a08863e791be4f9095a34471fd6abe76828dc8c653be8c66923a5802b31e
-
Filesize
531KB
MD5e4e4d47e09aa0b35e74e0382286e2dd8
SHA123fd781ab242985ad327211450e786cd95f92a57
SHA256883d8038dc7eaea4fee2cf702b6e1579e4778ebbcc73361bda2c34eb4ae48320
SHA512e06cf4c0495e57d886773928b9f3ca850a947d3ad056e09d2d4eef9ee1c741ff93335aaabb64b851c9b01ba78a6da18b663409a9824b10e8bd7c67f711dfcf0a
-
Filesize
190KB
MD5ad46d8f3deb8e678f3f953684d14b732
SHA104c755b4f95ed0373dc02ae9ba07dc81fbe657f1
SHA256657320a567c0673d7c79224f778c8ac3b0a10fd4b22c8b8f4694bb8fa307890a
SHA512968dad2d7f582ec691ce5b25d26017277e9decb4277f85565029407c0996dc1b3b4ee065f0f0986d23d4406a1f4c1fb9620b2e879d2693dcd3c94992fc8dfdb1
-
Filesize
167KB
MD57b4aca7528809016f9b3045b317f2321
SHA1e77c6e830851c1e325a6f025f68661ce962b0d28
SHA256c04b6c58196554b86239a429d85b5d7929d0197ef2ff67e2e2ba8c7f3a043f95
SHA512d96f91a8869fdd684aa95d5bb6cb703a79bbefda135f507825d8c37d5faa4eb94cacc33c02f7be82e6d6efba218bc681997d15688c43ddc4e5366b3378b6a4f7
-
Filesize
71KB
MD54fcd7574537cebec8e75b4e646996643
SHA1efa59bb9050fb656b90d5d40c942fb2a304f2a8b
SHA2568ea3b17e4b783ffc0bc387b81b823bf87af0d57da74541d88ba85314bb232a5d
SHA5127f1a7ef64d332a735db82506b47d84853af870785066d29ccaf4fdeab114079a9f0db400e01ba574776a0d652a248658fe1e8f9659cdced19ad6eea09644ea3e
-
Filesize
2.3MB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
2.3MB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
4KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
480KB
-
Filesize
480KB
-
Filesize
204KB
-
Filesize
480KB
-
Filesize
480KB
-
Filesize
480KB
-
Filesize
480KB
-
Filesize
480KB
-
Filesize
204KB
-
Filesize
480KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB