Overview

overview

10

Static

static

1

2025-03-03...ia.exe

windows7-x64

10

2025-03-03...ia.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2025-03-03_ae1ff32d2cb010b6c377e3501b838b90_floxif_mafia

  • Size

    3.9MB

  • Sample

    250303-qxqtjsyrv4

  • MD5

    ae1ff32d2cb010b6c377e3501b838b90

  • SHA1

    5cf09c7d3852eb91577c5cc6cacadab462cdef70

  • SHA256

    4de454e031b25751399a1f65f8a8c8e1dcd0d74bd4cc7b88502f6d8d6ca8afeb

  • SHA512

    ab62bf6fca891f60a2cb64801c6b8419d031abee84858284ff2be5515f6eba7061e1aa996bb299cd374ce9d1f3cf4f22475f2ba9fe1f3d8c6c0cf79aac150b81

  • SSDEEP

    98304:1g+ESjoa9kZ6DRwcEtzCyQWuKglLgxQfPn9rj+De0nzQUyp:1g+ESJ9k6bOuTgKn9rj+DoU2

Score
10/10
floxifbackdoordiscoverypersistenceprivilege_escalationtrojanupx

Malware Config

Targets

    • Target

      2025-03-03_ae1ff32d2cb010b6c377e3501b838b90_floxif_mafia

    • Size

      3.9MB

    • MD5

      ae1ff32d2cb010b6c377e3501b838b90

    • SHA1

      5cf09c7d3852eb91577c5cc6cacadab462cdef70

    • SHA256

      4de454e031b25751399a1f65f8a8c8e1dcd0d74bd4cc7b88502f6d8d6ca8afeb

    • SHA512

      ab62bf6fca891f60a2cb64801c6b8419d031abee84858284ff2be5515f6eba7061e1aa996bb299cd374ce9d1f3cf4f22475f2ba9fe1f3d8c6c0cf79aac150b81

    • SSDEEP

      98304:1g+ESjoa9kZ6DRwcEtzCyQWuKglLgxQfPn9rj+De0nzQUyp:1g+ESJ9k6bOuTgKn9rj+DoU2

    Score
    10/10
    floxifbackdoordiscoverypersistenceprivilege_escalationtrojanupx

    • Floxif family

      floxif

    • Floxif, Floodfix

      Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.

      backdoortrojanfloxif

    • Detects Floxif payload

      backdoor

    • Event Triggered Execution: AppInit DLLs

      Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

      persistenceprivilege_escalation

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks