Overview

overview

10

Static

static

1

2025-02-07...ia.exe

windows7-x64

10

2025-02-07...ia.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2025-02-07_634f9499b2c311973a6f09ca011ce899_floxif_mafia

  • Size

    2.5MB

  • Sample

    250207-hgegkssmgs

  • MD5

    634f9499b2c311973a6f09ca011ce899

  • SHA1

    af6906ab7dd7e42a970303171a0fba2acc4d6ef5

  • SHA256

    6fca8fc555d7d0bf90b2d93b9d5d74b543e06f20f2f4e04a7a308e7302c3eac5

  • SHA512

    85933cb26de5409c77774813816d08ec53a8852221c0ba61be3c0d7021fce01b85d66e1af2d8e2bf37ffefbfa22e3694147d578c0af57b4f76b2dcacef4ef2af

  • SSDEEP

    49152:tuIIApofs2hPd2l177BTK2VbDsar1YDjW:tjSfs2hPIl1/N

Score
10/10
floxifbackdoordiscoverypersistenceprivilege_escalationtrojanupx

Malware Config

Targets

    • Target

      2025-02-07_634f9499b2c311973a6f09ca011ce899_floxif_mafia

    • Size

      2.5MB

    • MD5

      634f9499b2c311973a6f09ca011ce899

    • SHA1

      af6906ab7dd7e42a970303171a0fba2acc4d6ef5

    • SHA256

      6fca8fc555d7d0bf90b2d93b9d5d74b543e06f20f2f4e04a7a308e7302c3eac5

    • SHA512

      85933cb26de5409c77774813816d08ec53a8852221c0ba61be3c0d7021fce01b85d66e1af2d8e2bf37ffefbfa22e3694147d578c0af57b4f76b2dcacef4ef2af

    • SSDEEP

      49152:tuIIApofs2hPd2l177BTK2VbDsar1YDjW:tjSfs2hPIl1/N

    Score
    10/10
    floxifbackdoordiscoverypersistenceprivilege_escalationtrojanupx

    • Floxif family

      floxif

    • Floxif, Floodfix

      Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.

      backdoortrojanfloxif

    • Detects Floxif payload

      backdoor

    • Event Triggered Execution: AppInit DLLs

      Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

      persistenceprivilege_escalation

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks