floxif | b452168d07a8a34c995e2423b5089248ac6f3e61bb2a625185c8ed716243c9d3 | Triage

Submit
Reports

Overview

overview

Static

static

1

b452168d07...d3.exe

windows7-x64

b452168d07...d3.exe

windows10-2004-x64

Sharing

General

Target

b452168d07a8a34c995e2423b5089248ac6f3e61bb2a625185c8ed716243c9d3
Size

1.9MB
Sample

250110-hesw7axqhl
MD5

dd4b73b01dfc8de31f637df5c25eb3b6
SHA1

c8df664b2e1a6c3e900bf55be9a5963e1a188c46
SHA256

b452168d07a8a34c995e2423b5089248ac6f3e61bb2a625185c8ed716243c9d3
SHA512

0fb79e4f929f43ee9bd65ba17dd6fa7023bebca8416afd836bf41c357fc0e512e71094c9babbca26ae6db467b11d2ecaff8524da3aa17e6967ff4448e0c8144b
SSDEEP

49152:IvjkIENdvYFSHJj8suwWuIekWxo1yDmoLTOZ3sFfppnBlF:IvVEjvYoH+suLuIekW2QmoLqZ3sFfpp9

Score

10^/10

floxif backdoor discovery persistence privilege_escalation trojan upx

Static task

static1

Behavioral task

behavioral1

Sample

b452168d07a8a34c995e2423b5089248ac6f3e61bb2a625185c8ed716243c9d3.exe

Resource

win7-20240903-en

floxif backdoor discovery trojan upx

windows7-x64

9 signatures

150 seconds

Behavioral task

behavioral2

Sample

b452168d07a8a34c995e2423b5089248ac6f3e61bb2a625185c8ed716243c9d3.exe

Resource

win10v2004-20241007-en

floxif backdoor discovery persistence privilege_escalation trojan upx

windows10-2004-x64

10 signatures

150 seconds

Malware Config

Targets

- Target
  
  b452168d07a8a34c995e2423b5089248ac6f3e61bb2a625185c8ed716243c9d3
- Size
  
  1.9MB
- MD5
  
  dd4b73b01dfc8de31f637df5c25eb3b6
- SHA1
  
  c8df664b2e1a6c3e900bf55be9a5963e1a188c46
- SHA256
  
  b452168d07a8a34c995e2423b5089248ac6f3e61bb2a625185c8ed716243c9d3
- SHA512
  
  0fb79e4f929f43ee9bd65ba17dd6fa7023bebca8416afd836bf41c357fc0e512e71094c9babbca26ae6db467b11d2ecaff8524da3aa17e6967ff4448e0c8144b
- SSDEEP
  
  49152:IvjkIENdvYFSHJj8suwWuIekWxo1yDmoLTOZ3sFfppnBlF:IvVEjvYoH+suLuIekW2QmoLqZ3sFfpp9
Score

10^/10

floxif backdoor discovery trojan upx persistence privilege_escalation
- Floxif family
  floxif
- Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Detects Floxif payload
  backdoor
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

AppInit DLLs

Privilege Escalation

Event Triggered Execution

AppInit DLLs

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

floxifbackdoordiscoverytrojanupx

behavioral2

floxifbackdoordiscoverypersistenceprivilege_escalationtrojanupx

© 2018-2025

Terms | Privacy