floxif | 3a3740f0cb93e6294d5f3951107558f0a29a66ac239b9f716ea2b4601c24c86a

General

Target

2025-02-03_08abaaf9de5d384c11b3c458db76d1d7_floxif_mafia
Size

1.8MB
Sample

250203-pld5yaspdq
MD5

08abaaf9de5d384c11b3c458db76d1d7
SHA1

49053c395190259e5dc3ef87719be70a5a2f7d2c
SHA256

3a3740f0cb93e6294d5f3951107558f0a29a66ac239b9f716ea2b4601c24c86a
SHA512

4b81ec45735967bcb146c60edefeb1ea81699fb19eae6c503a11909951d868c5a5f5bf7c2550926838982b0d43f7641ca68617a7ffad39fc2df5ea46376b8a3e
SSDEEP

49152:nggcdzpmooJe6qdqtDlAeloLfH79CAs/YeEN7M8SQSXLQhsAQJneWkqk:nqdzVoJe1qtDlAeGLfH79CAswe0Y8WQL

Score

10^/10

Malware Config

Targets

- Target
  
  2025-02-03_08abaaf9de5d384c11b3c458db76d1d7_floxif_mafia
- Size
  
  1.8MB
- MD5
  
  08abaaf9de5d384c11b3c458db76d1d7
- SHA1
  
  49053c395190259e5dc3ef87719be70a5a2f7d2c
- SHA256
  
  3a3740f0cb93e6294d5f3951107558f0a29a66ac239b9f716ea2b4601c24c86a
- SHA512
  
  4b81ec45735967bcb146c60edefeb1ea81699fb19eae6c503a11909951d868c5a5f5bf7c2550926838982b0d43f7641ca68617a7ffad39fc2df5ea46376b8a3e
- SSDEEP
  
  49152:nggcdzpmooJe6qdqtDlAeloLfH79CAs/YeEN7M8SQSXLQhsAQJneWkqk:nqdzVoJe1qtDlAeGLfH79CAswe0Y8WQL
Score

10^/10

floxif backdoor discovery lateral_movement persistence privilege_escalation trojan upx
- Floxif family
  floxif
- Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Detects Floxif payload
  backdoor
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- Modifies RDP port number used by Windows
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Remote Services: SMB/Windows Admin Shares
  Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).
  lateral_movement
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2