floxif | f2ad8c01f666e3c8f2b37700952fd9904e8926eeefd32221e51807a53f56d7c7

General

Target

f2ad8c01f666e3c8f2b37700952fd9904e8926eeefd32221e51807a53f56d7c7N.exe
Size

1.1MB
Sample

250123-dtgegs1jam
MD5

0a1d0f9601ef2b78571d18385168ea10
SHA1

a19f93c8d2996be6ecd245232c8f01e240584c93
SHA256

f2ad8c01f666e3c8f2b37700952fd9904e8926eeefd32221e51807a53f56d7c7
SHA512

3a18f9f1d6623825ad0588684171264a53efebb71c78e9b192f719910e5d45ab8f0988421c15b55d9a7b9a6728e6303a255ac4a4ad86a20ff8b078afe33166b1
SSDEEP

24576:TaoLctDQhBamqpJ8bTz5h0ZfzJYgcid68Ih44W3Di+6ok6Dz2rEH7C:TaoLcxsgozgZfzCJ83Diqfw

Score

10^/10

Malware Config

Targets

- Target
  
  f2ad8c01f666e3c8f2b37700952fd9904e8926eeefd32221e51807a53f56d7c7N.exe
- Size
  
  1.1MB
- MD5
  
  0a1d0f9601ef2b78571d18385168ea10
- SHA1
  
  a19f93c8d2996be6ecd245232c8f01e240584c93
- SHA256
  
  f2ad8c01f666e3c8f2b37700952fd9904e8926eeefd32221e51807a53f56d7c7
- SHA512
  
  3a18f9f1d6623825ad0588684171264a53efebb71c78e9b192f719910e5d45ab8f0988421c15b55d9a7b9a6728e6303a255ac4a4ad86a20ff8b078afe33166b1
- SSDEEP
  
  24576:TaoLctDQhBamqpJ8bTz5h0ZfzJYgcid68Ih44W3Di+6ok6Dz2rEH7C:TaoLcxsgozgZfzCJ83Diqfw
Score

10^/10

floxif backdoor defense_evasion discovery persistence privilege_escalation trojan upx
- Floxif family
  floxif
- Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Detects Floxif payload
  backdoor
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2