floxif | bd18ea2666e9f050009d4f1324512875f5bb94994e72f0470f6f5e87453883ea | Triage

Submit
Reports

Overview

overview

Static

static

bd18ea2666...ea.dll

windows7-x64

8

bd18ea2666...ea.dll

windows10-2004-x64

5

Sharing

General

Target

bd18ea2666e9f050009d4f1324512875f5bb94994e72f0470f6f5e87453883ea.exe
Size

76KB
Sample

250121-lcm5pswpd1
MD5

130a5b24228da1677004f32dbbd731f4
SHA1

3b96d009d0133153b3ef17e590ad49bf980fe574
SHA256

bd18ea2666e9f050009d4f1324512875f5bb94994e72f0470f6f5e87453883ea
SHA512

af54e248d747c0d4fc2ad1f1aeec3942a9a086563f3863b412d33bf04343cff17d251392135097234ab17c29f7e86d0ccedd270814666e6b9a093e2a9b4b9718
SSDEEP

1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7ZK6/89fBlp:c8y93KQjy7G55riF1cMo03Y6/895lp

Score

10^/10

floxif backdoor discovery persistence privilege_escalation upx

Static task

static1

backdoor upx floxif

5 signatures

Behavioral task

behavioral1

Sample

bd18ea2666e9f050009d4f1324512875f5bb94994e72f0470f6f5e87453883ea.dll

Resource

win7-20241010-en

discovery persistence privilege_escalation upx

windows7-x64

6 signatures

120 seconds

Behavioral task

behavioral2

Sample

bd18ea2666e9f050009d4f1324512875f5bb94994e72f0470f6f5e87453883ea.dll

Resource

win10v2004-20241007-en

windows10-2004-x64

5 signatures

120 seconds

Malware Config

Targets

- Target
  
  bd18ea2666e9f050009d4f1324512875f5bb94994e72f0470f6f5e87453883ea.exe
- Size
  
  76KB
- MD5
  
  130a5b24228da1677004f32dbbd731f4
- SHA1
  
  3b96d009d0133153b3ef17e590ad49bf980fe574
- SHA256
  
  bd18ea2666e9f050009d4f1324512875f5bb94994e72f0470f6f5e87453883ea
- SHA512
  
  af54e248d747c0d4fc2ad1f1aeec3942a9a086563f3863b412d33bf04343cff17d251392135097234ab17c29f7e86d0ccedd270814666e6b9a093e2a9b4b9718
- SSDEEP
  
  1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7ZK6/89fBlp:c8y93KQjy7G55riF1cMo03Y6/895lp
Score

8^/10

discovery persistence privilege_escalation upx
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

AppInit DLLs

Privilege Escalation

Event Triggered Execution

AppInit DLLs

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

backdoorupxfloxif

behavioral1

discoverypersistenceprivilege_escalationupx

behavioral2

© 2018-2025

Terms | Privacy