Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
24-01-2025 01:46
General
-
Target
2025-01-24_e801da09557b68ffa6c7a73f0dead57c_floxif_mafia.exe
-
Size
14.6MB
-
MD5
e801da09557b68ffa6c7a73f0dead57c
-
SHA1
f31c44c0184c50af8ae9a9d8a226ec8c2cb97be8
-
SHA256
3eb68e311dc58cb703d0a97fbdf0ed7114042897cffd5d9001cff480426394b5
-
SHA512
a4cc6f3ea115f8968360ff34b69c1123955a5e0f3a2d0cb51f6be5c2db67c0aa8df59876b1ebc01529de32a2608a388afb9bcd1904a7495ca63d28503f400a33
-
SSDEEP
393216:vwbNIiOlfxzYA+VR5Y4yiOlfxEc/J3VvpJ2f623Kbl:YbNAwVRODEcXvpeKbl
Malware Config
Signatures
-
Floxif family
-
Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
-
Detects Floxif payload 1 IoCs
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
-
Loads dropped DLL 2 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Program Files directory 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-01-24_e801da09557b68ffa6c7a73f0dead57c_floxif_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2025-01-24_e801da09557b68ffa6c7a73f0dead57c_floxif_mafia.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
13.9MB
MD5f9598c86be6ab8ed187a5be159b07822
SHA17f9e8ab5466ee25cc452b9b99eb37f70731f1930
SHA256fdbe8d73a09661a065a59a5368bca8b9f3ab2621a8196a3cbfdccc1c56372591
SHA512a1d4a3b0fd641f8b76a171dd65580cdcdf078b746e2fb71679e3465f000cdadd44051f96f7a6aa83357b8feb55cf4e1c44cacfa6b9ddcee48eb6d43b8dad5e53
-
Filesize
67KB
MD57574cf2c64f35161ab1292e2f532aabf
SHA114ba3fa927a06224dfe587014299e834def4644f
SHA256de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
SHA5124db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab
-
Filesize
14.0MB
MD5813f670600fed2e27386bf47549226df
SHA199aab4321f442f7c316bbb01515c483d700e046b
SHA25618500df21f846866926307e3ae4e1a0722ff8cac89281cefd959846286d398bd
SHA512e7fcba2c9ecf0d2f4231fcad0177923468f7af6e0ee21e25ef9e97da41e4f7098bce2d661b13320477221e4fdb1ec205c41e447c39a33aa4c9e6ecd658364531
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
14.4MB