General

  • Target

    2025-05-03_f69597e7e27e9ea639ab7f43c62004dc_darkgate_elex_floxif_icedid_rhadamanthys

  • Size

    13.1MB

  • Sample

    250503-kw8p3szycy

  • MD5

    f69597e7e27e9ea639ab7f43c62004dc

  • SHA1

    0db6115febf73d6d15071128eebd303d7f4126f3

  • SHA256

    a4986da64e2984cc13a3e05fb21b863a4b4999b253ad9607fc6929a653deaf64

  • SHA512

    b4dc16d8fe54085e348bc8b1a94be1b2054f29c85752f6fbcc8e190f756330168eeb9ce346df9c004b953ef116ccc1fc9ec25c8f21d04dd0ba4833834acde9f3

  • SSDEEP

    393216:TjnnwmatWZ+mgSbBXxKqLupZr6KbkeJO0:TjnwmapSDsu7e1

Malware Config

Targets

    • Target

      2025-05-03_f69597e7e27e9ea639ab7f43c62004dc_darkgate_elex_floxif_icedid_rhadamanthys

    • Size

      13.1MB

    • MD5

      f69597e7e27e9ea639ab7f43c62004dc

    • SHA1

      0db6115febf73d6d15071128eebd303d7f4126f3

    • SHA256

      a4986da64e2984cc13a3e05fb21b863a4b4999b253ad9607fc6929a653deaf64

    • SHA512

      b4dc16d8fe54085e348bc8b1a94be1b2054f29c85752f6fbcc8e190f756330168eeb9ce346df9c004b953ef116ccc1fc9ec25c8f21d04dd0ba4833834acde9f3

    • SSDEEP

      393216:TjnnwmatWZ+mgSbBXxKqLupZr6KbkeJO0:TjnwmapSDsu7e1

    • Floxif family

    • Floxif, Floodfix

      Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.

    • Detects Floxif payload

    • Modifies boot configuration data using bcdedit

    • Manipulates Digital Signatures

      Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Executes dropped EXE

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v16

Tasks