Overview

overview

10

Static

static

1

16609acddf...b3.exe

windows7-x64

10

16609acddf...b3.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    16609acddf5ffbb26b48e26806a08054ee1d67798592f084efd279f4c01efeb3

  • Size

    286KB

  • Sample

    250207-gwtpda1qex

  • MD5

    3b65662052857c742ac0d9e7f21c2291

  • SHA1

    ac9a0b503045a4e5b22f4a315f55738ac1a1197e

  • SHA256

    16609acddf5ffbb26b48e26806a08054ee1d67798592f084efd279f4c01efeb3

  • SHA512

    6f0720cdf9033da8e1ba58311fee2729c8743a4acd552099316373d1354fd8fdb43f000d3aeca9a974df39d6858557dd949f3846bcfe620b47f9dc1b9aea9d7f

  • SSDEEP

    6144:+7re/5kHouyXnZhB+h8WHlBV+UdvrEFp7hKt:+7re/JuyXnPB+h8WHlBjvrEH7W

Score
10/10
floxifbackdoordiscoverypersistenceprivilege_escalationtrojanupx

Malware Config

Targets

    • Target

      16609acddf5ffbb26b48e26806a08054ee1d67798592f084efd279f4c01efeb3

    • Size

      286KB

    • MD5

      3b65662052857c742ac0d9e7f21c2291

    • SHA1

      ac9a0b503045a4e5b22f4a315f55738ac1a1197e

    • SHA256

      16609acddf5ffbb26b48e26806a08054ee1d67798592f084efd279f4c01efeb3

    • SHA512

      6f0720cdf9033da8e1ba58311fee2729c8743a4acd552099316373d1354fd8fdb43f000d3aeca9a974df39d6858557dd949f3846bcfe620b47f9dc1b9aea9d7f

    • SSDEEP

      6144:+7re/5kHouyXnZhB+h8WHlBV+UdvrEFp7hKt:+7re/JuyXnPB+h8WHlBjvrEH7W

    Score
    10/10
    floxifbackdoordiscoverypersistenceprivilege_escalationtrojanupx

    • Floxif family

      floxif

    • Floxif, Floodfix

      Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.

      backdoortrojanfloxif

    • Detects Floxif payload

      backdoor

    • Event Triggered Execution: AppInit DLLs

      Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

      persistenceprivilege_escalation

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks