Overview

overview

10

Static

static

1

fa7b152ae5...45.exe

windows7-x64

10

fa7b152ae5...45.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fa7b152ae50312ff94e61916786d15bbe95b9505f3fd5dd88d747cd648ccbe45

  • Size

    234KB

  • Sample

    250110-g4453svmhx

  • MD5

    3946066764820fb5018b50094ef1a98f

  • SHA1

    87f6477fb335b537a28e43501f0fd0bfc89e6fa2

  • SHA256

    fa7b152ae50312ff94e61916786d15bbe95b9505f3fd5dd88d747cd648ccbe45

  • SHA512

    4ce712be6d23972eb0755f4b4ab7d5bd8764a4389ac8c0de4d7bb4607422b712998a774e05666ec8ec630f7bbba43591a9b0dc72909737703ae1791848b0f6af

  • SSDEEP

    3072:HwzvOYZJ5YP/aKavT/DxZ9aobNI2B+JlIjDe7kal2n1TWl9o1B0C98CqtVFiDfl7:oJiP/aK2xZ9H/B+rTBV+UdvrEFp7hKA

Score
10/10
floxifbackdoordiscoverypersistenceprivilege_escalationtrojanupx

Malware Config

Targets

    • Target

      fa7b152ae50312ff94e61916786d15bbe95b9505f3fd5dd88d747cd648ccbe45

    • Size

      234KB

    • MD5

      3946066764820fb5018b50094ef1a98f

    • SHA1

      87f6477fb335b537a28e43501f0fd0bfc89e6fa2

    • SHA256

      fa7b152ae50312ff94e61916786d15bbe95b9505f3fd5dd88d747cd648ccbe45

    • SHA512

      4ce712be6d23972eb0755f4b4ab7d5bd8764a4389ac8c0de4d7bb4607422b712998a774e05666ec8ec630f7bbba43591a9b0dc72909737703ae1791848b0f6af

    • SSDEEP

      3072:HwzvOYZJ5YP/aKavT/DxZ9aobNI2B+JlIjDe7kal2n1TWl9o1B0C98CqtVFiDfl7:oJiP/aK2xZ9H/B+rTBV+UdvrEFp7hKA

    Score
    10/10
    floxifbackdoordiscoverypersistenceprivilege_escalationtrojanupx

    • Floxif family

      floxif

    • Floxif, Floodfix

      Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.

      backdoortrojanfloxif

    • Detects Floxif payload

      backdoor

    • Event Triggered Execution: AppInit DLLs

      Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

      persistenceprivilege_escalation

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks