Overview

overview

10

Static

static

1

2025-04-03...er.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2025-04-03_3478b6e4e326c3ef09638f777e4712da_amadey_black-basta_floxif_hijackloader_luca-stealer

  • Size

    964KB

  • Sample

    250403-v7dn7az1h1

  • MD5

    3478b6e4e326c3ef09638f777e4712da

  • SHA1

    e5a7b62414daa61ee9c883081b4b0bf55c3c276a

  • SHA256

    5c0c16303b71a6679d8f496a75baff3669e7f22973037706260fa1f669ec9cdd

  • SHA512

    17d0ac4257f6949933a9952d183b728eb06ecd20b8487840a7cad0e066e44a1e2c4240ad32299425aca4f154811671723331083ba126e8de29d815a4b77aea91

  • SSDEEP

    12288:XNpRYfy+yp95siV3ztYnxXKbJS5ZPPqmHiKv2l2NEaRrsepLIjsweduFFVIURngX:XNs6YnxXTMKvSL0LR2FXqXzZrEH7w

Score
10/10
floxifbackdoordiscoverypersistenceprivilege_escalationtrojanupx

Malware Config

Targets

    • Target

      2025-04-03_3478b6e4e326c3ef09638f777e4712da_amadey_black-basta_floxif_hijackloader_luca-stealer

    • Size

      964KB

    • MD5

      3478b6e4e326c3ef09638f777e4712da

    • SHA1

      e5a7b62414daa61ee9c883081b4b0bf55c3c276a

    • SHA256

      5c0c16303b71a6679d8f496a75baff3669e7f22973037706260fa1f669ec9cdd

    • SHA512

      17d0ac4257f6949933a9952d183b728eb06ecd20b8487840a7cad0e066e44a1e2c4240ad32299425aca4f154811671723331083ba126e8de29d815a4b77aea91

    • SSDEEP

      12288:XNpRYfy+yp95siV3ztYnxXKbJS5ZPPqmHiKv2l2NEaRrsepLIjsweduFFVIURngX:XNs6YnxXTMKvSL0LR2FXqXzZrEH7w

    Score
    10/10
    floxifbackdoordiscoverypersistenceprivilege_escalationtrojanupx

    • Floxif family

      floxif

    • Floxif, Floodfix

      Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.

      backdoortrojanfloxif

    • Detects Floxif payload

      backdoor

    • Event Triggered Execution: AppInit DLLs

      Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

      persistenceprivilege_escalation

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks