floxif | 198d8757e1d9288b597f9b2f12d75f7c3bf703055c684d08a499e222516a6511 | Triage

Submit
Reports

Overview

overview

Static

static

1

198d8757e1...11.dll

windows7-x64

198d8757e1...11.dll

windows10-2004-x64

Sharing

General

Target

198d8757e1d9288b597f9b2f12d75f7c3bf703055c684d08a499e222516a6511
Size

183KB
Sample

250125-zacsva1kcm
MD5

b61bd181a51ede5958e78ea2a37a9b1c
SHA1

7a4f9fb722ac89b57b7215a72a50a3bb26541be3
SHA256

198d8757e1d9288b597f9b2f12d75f7c3bf703055c684d08a499e222516a6511
SHA512

d4b2099ed022177749650de9bd45fefed88487c742a4750de5f1c5c3f8e3d6117e425a54e24847b76a6799f2e4a8b9bfa7e8338778797734ca7ea157c55c71b1
SSDEEP

3072:6G1eI8tNqL7+LbNQDCVyymQXH5SjjJ2lQBV+UdE+rECWp7hKXOn:6GsltA2YyXX5SNBV+UdvrEFp7hKXOn

Score

10^/10

floxif backdoor discovery trojan upx

Static task

static1

Behavioral task

behavioral1

Sample

198d8757e1d9288b597f9b2f12d75f7c3bf703055c684d08a499e222516a6511.dll

Resource

win7-20241010-en

floxif backdoor discovery trojan upx

windows7-x64

13 signatures

150 seconds

Behavioral task

behavioral2

Sample

198d8757e1d9288b597f9b2f12d75f7c3bf703055c684d08a499e222516a6511.dll

Resource

win10v2004-20241007-en

floxif backdoor discovery trojan upx

windows10-2004-x64

13 signatures

150 seconds

Malware Config

Targets

- Target
  
  198d8757e1d9288b597f9b2f12d75f7c3bf703055c684d08a499e222516a6511
- Size
  
  183KB
- MD5
  
  b61bd181a51ede5958e78ea2a37a9b1c
- SHA1
  
  7a4f9fb722ac89b57b7215a72a50a3bb26541be3
- SHA256
  
  198d8757e1d9288b597f9b2f12d75f7c3bf703055c684d08a499e222516a6511
- SHA512
  
  d4b2099ed022177749650de9bd45fefed88487c742a4750de5f1c5c3f8e3d6117e425a54e24847b76a6799f2e4a8b9bfa7e8338778797734ca7ea157c55c71b1
- SSDEEP
  
  3072:6G1eI8tNqL7+LbNQDCVyymQXH5SjjJ2lQBV+UdE+rECWp7hKXOn:6GsltA2YyXX5SNBV+UdvrEFp7hKXOn
Score

10^/10

floxif backdoor discovery trojan upx
- Floxif family
  floxif
- Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Detects Floxif payload
  backdoor
- Blocklisted process makes network request
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

floxifbackdoordiscoverytrojanupx

behavioral2

floxifbackdoordiscoverytrojanupx

© 2018-2025

Terms | Privacy