Extracted

• • Target

    d3e8e9580909bc27dff8729c238b041ae8df92b5ac014a9ff263b8ae5d61f520N.exe

  • Size

    1.6MB

  • MD5

    fcc64066841bc611877a15d6bedd5d70

  • SHA1

    946edd5a306bddc787f51047044b7ff363419fdc

  • SHA256

    d3e8e9580909bc27dff8729c238b041ae8df92b5ac014a9ff263b8ae5d61f520

  • SHA512

    425dad1e3120dad76249729a37db4e150403888f74dc3534ebea002a2755a5b3369081770305ee5654326e8dfb41b8253c635d34bf13b57c0c5df3f16b11ec5c

  • SSDEEP

    24576:1nsJ39LyjbJkQFMhmC+6GD9LaHGvMCrrjSnyIQ8+ekGA8PSmMrEH7R:1nsHyjtk2MYC5GD9fvLjlIQxe5S6

  Score

  10^/10

  floxifxredbackdoordefense_evasiondiscoveryevasionmacropersistenceprivilege_escalationtrojanupx

  • Floxif family

    floxif

  • Floxif, Floodfix

    Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.

    backdoortrojanfloxif

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • Modifies security service

    defense_evasion

  • Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Xred family

    xred

  • Detects Floxif payload

    backdoor

  • Downloads MZ/PE file

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Suspicious Office macro

    Office document equipped with macros.

    macro

  • ACProtect 1.3x - 1.4x DLL software

    Detects file using ACProtect software.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    defense_evasiontrojan

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2