Overview

overview

10

Static

static

1

07a1896631...04.dll

windows7-x64

10

07a1896631...04.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    07a189663102b09aa7fb9113abf72bafbb5bd22daaeed37ff9109f5e21949e04

  • Size

    377KB

  • Sample

    250130-r5qn7atpft

  • MD5

    2d073222069feb10a48f6d1d4a0e0dc5

  • SHA1

    6e201449c35593a274ad301d7a92fa66b2501ec2

  • SHA256

    07a189663102b09aa7fb9113abf72bafbb5bd22daaeed37ff9109f5e21949e04

  • SHA512

    57ef848db705e185a86526799f96127a7b00fd82672ec65c53bbb0cb5bed2d2c659202703146438778dbf211ad51137b5c5e4597b40d5f5b9ea5b49133b2c586

  • SSDEEP

    6144:WJ3KbqxdjkUe+wQ+Rm60lb/vtPJYb+QMb1+6wb2sj6pCrmYBV+UdvrEFp7hKeQcs:WhT1Bb/vtPJYb+QMb1+6wbBsImYBjvrR

Score
10/10
floxifbackdoordiscoverypersistenceprivilege_escalationtrojanupx

Malware Config

Targets

    • Target

      07a189663102b09aa7fb9113abf72bafbb5bd22daaeed37ff9109f5e21949e04

    • Size

      377KB

    • MD5

      2d073222069feb10a48f6d1d4a0e0dc5

    • SHA1

      6e201449c35593a274ad301d7a92fa66b2501ec2

    • SHA256

      07a189663102b09aa7fb9113abf72bafbb5bd22daaeed37ff9109f5e21949e04

    • SHA512

      57ef848db705e185a86526799f96127a7b00fd82672ec65c53bbb0cb5bed2d2c659202703146438778dbf211ad51137b5c5e4597b40d5f5b9ea5b49133b2c586

    • SSDEEP

      6144:WJ3KbqxdjkUe+wQ+Rm60lb/vtPJYb+QMb1+6wb2sj6pCrmYBV+UdvrEFp7hKeQcs:WhT1Bb/vtPJYb+QMb1+6wbBsImYBjvrR

    Score
    10/10
    floxifbackdoordiscoverypersistenceprivilege_escalationtrojanupx

    • Floxif family

      floxif

    • Floxif, Floodfix

      Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.

      backdoortrojanfloxif

    • Detects Floxif payload

      backdoor

    • Event Triggered Execution: AppInit DLLs

      Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

      persistenceprivilege_escalation

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks