floxif | 6f101b9fa8e4ec3bd78ef6fcb9a917cfa7c024a3e687a228d4d8f38d39090464

Sharing

Copy URL Twitter E-mail

General

Target
Subway Surfers.tar.gz
Size 23.0MB
Sample260716-yexhdact3q
SHA256 6f101b9fa8e4ec3bd78ef6fcb9a917cfa7c024a3e687a228d4d8f38d39090464
MD5 cb5663eadb90d7fc70017de418ca71a2
SHA1 24cb6e226fe64ce4ddca02419b5ccaa20e099778
SHA512 5505d28fd5bf05c1fd5cfcd4897003eaa26853c8d5cc9a0558b6afa568e853a2a3f8456fd3da6998e13600d272957524d757e7695fe65446f46b48131a0cef20
SSDEEP 393216:oyGPgj769dmDi8ZQLDTyUzpDO3SUYYxDYtJTncMZmc7i0MBuBci6+AWURLpC2x0/:ow7ymDi57TzpgSzuMLbcMkYnKurAWYDI
TLSH
T160373356D084B3E6694D33C20FE6D4A618623C3327F47A5B0A7F3B9904EFC911A86797
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Subway Surfers.tar.gz
- Size 23.0MB
- SHA256 6f101b9fa8e4ec3bd78ef6fcb9a917cfa7c024a3e687a228d4d8f38d39090464
- MD5 cb5663eadb90d7fc70017de418ca71a2
- SHA1 24cb6e226fe64ce4ddca02419b5ccaa20e099778
- SHA512 5505d28fd5bf05c1fd5cfcd4897003eaa26853c8d5cc9a0558b6afa568e853a2a3f8456fd3da6998e13600d272957524d757e7695fe65446f46b48131a0cef20
- SSDEEP 393216:oyGPgj769dmDi8ZQLDTyUzpDO3SUYYxDYtJTncMZmc7i0MBuBci6+AWURLpC2x0/:ow7ymDi57TzpgSzuMLbcMkYnKurAWYDI
- TLSH
  T160373356D084B3E6694D33C20FE6D4A618623C3327F47A5B0A7F3B9904EFC911A86797
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Subway Surfers/Subway_Surfers.exe
- Size 8.7MB
- SHA256 892e5e86615a3579babdacf8b989190a53759d9268f2037882653aa072c8cd2c
- MD5 f43c3eeca7a4813d0ca3a667505124a2
- SHA1 3eacc14671e4a54a1d834b243aff28b4a7b57799
- SHA512 6dc2cec0295604b8e47b0b2150ca8f71c5104e41ed70ae2bffd6be073bd0a56425a48128e44e85c2af38797817c1bbe7d87399f5e5976db702d1c5f29516311e
- SSDEEP 196608:nsV+/bRu/R9X49Lj4FM40m/j22jqHtbn9kMFcbo2NirKqwgi:tY/vo9LsFM40m/j22CqboKig
- TLSH
  T17596C021F992C0B1E99B3A71B53D763FB938B7110B1D41C3B7D82D05DA706E16AB9382
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor discovery floxif persistence privilege_escalation trojan upx
- Family: Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Detects Floxif payload
  backdoor
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Loads dropped DLL
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral3 behavioral4
- Target
  Subway Surfers/Subway_Surfers_Data/Managed/Assembly-CSharp-firstpass.dll
- Size 44KB
- SHA256 8aa9d9f2f5dc3339f4f0dd1f79e02628757b790bd1a94b61a7db06fe6e74f31c
- MD5 d7e05b69b06142549ac7d467a14a386d
- SHA1 553a913454357d10d8a8d43d3784d7da9d444972
- SHA512 f7abb33921ab12b0d3e1d8881879cd23eae068874ac8dbf8c390495f43da5e7335b8ee5184fd56e751acfc25e0605ce6351f8912ae664ce66d48eefbc6e0f7ac
- SSDEEP 768:ycWVXQV/g1jUd5k9gEZLPiB+xUnINc3oZMz7fSQgKSq1adzJZqNX7TN6O:KAV/g1jUd5k9gEZtOnINcxP+JZqNXXMO
- TLSH
  T1A113E649A7F0801AD7FD8B38987301008A31F8976E37F76EA3D6105A1C37794DA657AE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  Subway Surfers/Subway_Surfers_Data/Managed/Assembly-CSharp.dll
- Size 521KB
- SHA256 d9e9d7965b164bfaba219c6710585183205859e99d0d3991da1226d311df2a8a
- MD5 c2b3a794594941c11969ed544192ab44
- SHA1 1da29cc4584b850fd6819a5b676ba5cc10e577bf
- SHA512 4ef0a4ed6d53cc99da5424126732419dc66ac7a56810a981460fb920a26d4b7f6794d677a2c239fe2567fe5e8ea2bb18f8a36bd60b07a7b8cbea8b697ab252b6
- SSDEEP 6144:eWw63LrSchXmy9TofvCJJ8+j7KOJ4zukNs+5zAkBqSosvWDFnjRYB6kXlJZqMpcq:ei33XXVefB+jUvRWDFnjRoAX3
- TLSH
  T111B4186127E0DA27E5BF5BBA90F1091997B5A407F69AEBCE0CC4E0FC1883B115D0536B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  Subway Surfers/Subway_Surfers_Data/Managed/Mono.Security.dll
- Size 286KB
- SHA256 4976aa62db4c38271123837ad37ea4331d0e36b44b5fd72a2e9e5ff6803afa9a
- MD5 080e3471987d4855230674998dbadca0
- SHA1 95b0657888bf8f99371b0d3db0a8283952d33cf8
- SHA512 83add80b5ff080a8480f3207c1b456085fa5b9c6bac1e4ec7c7278bfc0b52736d6601b52b677cf0013aac9c7827bd88b1f5049d2298831ba91418e28081af39e
- SSDEEP 6144:lyH9c7SOEtITswi6JRR0/oGUmzuT8CaePmH7F:wSkyswj0/opSuYAg
- TLSH
  T1215439086BE8DB67F1BE63B8D0F04015CBF8A556B1AFFF5E1C8614E818137519A01A6F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  Subway Surfers/Subway_Surfers_Data/Managed/System.Core.dll
- Size 262KB
- SHA256 1eeb4994ba124a17bc36d8a462f07a6b102751714854b8c83e27ac8a7daa64d9
- MD5 01f43ab70e335e5748fb8d0e117fb899
- SHA1 54ce201a050f4804d71f2a3dfe975435a6774f4e
- SHA512 0b58d051889afd3c8823fdc1b275bf62e90040c1ee17c223b1f625c93957364c4c369d58899eba3d26008d5926e6ba0706db488b1aab417812ebdf736fdc173a
- SSDEEP 3072:LpHBMkH/a1xU5aV2JkMeztKlRbCuoy7ytyOygjqVwnGk0E7ENAbGCkbwfAXM6Obh:LphYIk0lRbMOfrE4KyM
- TLSH
  T12F444D9497EC9613E3FF93B1E870070507F4B4A6B0A7E30E589851F65C4BB816E463AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  Subway Surfers/Subway_Surfers_Data/Managed/System.dll
- Size 1.0MB
- SHA256 24ceaf4f611145ed3efdc6672a57d4dac3d8155f3ebe592be424e30131a5a146
- MD5 8211a8883de2ce8f37f78a5360d2fcdc
- SHA1 15ca0c893a38f4b1c1c434b1db9d1064a411fc02
- SHA512 f9cbe03ea2b804e2b6912fdb134b5004284dcb4dafe26451f89485f23514454e5e4e2dcd6c4dda6f7e8537a449fd7551663ac7f54bd2e509a29374679f7a561f
- SSDEEP 24576:00v/NC/rYD3pZ2I6kBJ8P7JG8zAFPTpS5v:00v/NC/3IoP7JG8zAFPTp
- TLSH
  T16F354B2067E4CB2BE1BE67BDB0B210115BB4E045F363EBAF559865982C83B405D463BF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  Subway Surfers/Subway_Surfers_Data/Managed/UnityEngine.dll
- Size 461KB
- SHA256 5f066604418eeb5585aeb1480b5fbe1e4508845d7aadd0b73fced6e3b6bdca64
- MD5 ff2b5f4fbbf326b30f92a5579461f44d
- SHA1 06f038b76176b95f000a8370decadf13e5cd556b
- SHA512 1df06e7ac690d0f66c9a0a2938209a38410726481b9b9357bef95bed66d285ba33a41deda81f4455370b5758064c1ac0dfbddd46b354ef6607b19245ebb9393e
- SSDEEP 6144:kLoSgXtbdxCI8mHGrLIavMNpPmq5KDfT4XrCghaJYjh+KGs:tSgXtRxf2EDnPHgmrCgh8t
- TLSH
  T1ACA41A546BE4D86BCB4D03B6E0A948695374E3246346E3CF246A50787CA331B4F376EB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  Subway Surfers/Subway_Surfers_Data/Managed/mscorlib.dll
- Size 2.4MB
- SHA256 bd5518235681868c79f699a74c87afd4a4166ae542805dd3f2e46e4ac934d2e9
- MD5 05e4ce0c0ee68e09c5e185bd9fe46052
- SHA1 7a8002e4fabdb02f6aa6ffddf1b3049358b8bcc3
- SHA512 43fdfd75a452ac77249a31bd821033ba9a7964077c6f2edbef684e043cbc87682e325fc0424a5225a6b6db306d6e3771f83c1847685e625be2bd7135c488f1ae
- SSDEEP 24576:vrEPejrrwWs7EREbghUr6oG9XUy9ssrURpZM/b+J1N/:vw8lREbgX9ssrURpZMT+J
- TLSH
  T142C53A51ABF5CA2BF67AAB74E4B100141BF4F856B362E74F361812BC0C93344AC5676B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  Subway Surfers/Subway_Surfers_Data/Mono/etc/mono/1.0/DefaultWsdlHelpGenerator.aspx
- Size 56KB
- SHA256 d87d5196b2ae2abf4e673315e1fd22c3a44df80192f23e89b78108579c287524
- MD5 66fed2411c14a0fc8ce4c593ef601bfb
- SHA1 4680a34aae1193f1e4a6aac1a5dd3c307de257fb
- SHA512 331874a9956c87db0646e4d21937a88009804a59fdf5f5882ea5b1dfb7dd7ef17724e09877d98f52e7327bbf38a46dde0c54d5c85f1e860b88322bdfad64679d
- SSDEEP 768:M28utHkOFpMgMwP9h5Ij7khsp/6JtEZwMxVtkUI353cXyEyk3VbNb1gNuoT1y:ZDF6CdsCOZwMx3k5JYyklhxgRw
- TLSH
  T17743C4A0EF5C8D36499A52D9F88140CCB9BDC43291199CF3FCCDA12AF09CD6DA274766
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  Subway Surfers/Subway_Surfers_Data/Mono/etc/mono/1.0/machine.config
- Size 16KB
- SHA256 1ba3755323483de257587a7276180c65d96824d441f95feb28f819e77a0cf767
- MD5 8dccd9a98d2575162aa366224a983c08
- SHA1 4eedcaa785182201857134d8432807bc30742f6a
- SHA512 96b6beb2bf56334ad5e7d0b95079107ce736b45011679bf9a2ecd295636ceb7f0748e84bdebfdde37cfe45ab28716e4cc5fe2441e986777369a319cc0c5ecfc5
- SSDEEP 192:lhUisXjWXWEeEe90sEG9+RbwlP/waMGyR29yaDVPpAayW2x02GFGyC2xI2nb2kZX:lhU/Dvmbw5t/
- TLSH
  T1C1721230670DBD1ECA4126629870A9D1067F7B4E96ACED4CA5FF232EE917087D3521E3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral21 behavioral22
- Target
  Subway Surfers/Subway_Surfers_Data/Mono/etc/mono/2.0/Browsers/Compat.browser
- Size 1KB
- SHA256 8a1082057ac5681dcd4e9c227ed7fb8eb42ac1618963b5de3b65739dd77e2741
- MD5 0d831c1264b5b32a39fa347de368fe48
- SHA1 187dff516f9448e63ea5078190b3347922c4b3eb
- SHA512 4b7549eda1f8ed2c4533d056b62ca5030445393f9c6003e5ee47301ff7f44b4bd5022b74d54f571aa890b6e4593c6eded1a881500ac5ba2a720dc0ff280300af
- TLSH
  T1EA3171A238DCACE0ED7300B3FA1F14897F1A897F5B8A1505748BA1560B019B443BB39D
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral23 behavioral24
- Target
  Subway Surfers/Subway_Surfers_Data/Mono/etc/mono/2.0/DefaultWsdlHelpGenerator.aspx
- Size 59KB
- SHA256 ae044cd9cc2c7c42f8864195125ab440472d657e5f0d55e131f7890bd45c518a
- MD5 3b3452c399f27a24ea5a589c7bfe750b
- SHA1 b06cb1d09ad3bbdf1d8214c910e3da2a228d113c
- SHA512 41c099350159e942be8bc04c8f59c7fb0fd4bd99db46f1c0158f0fa053c08ae0c73e9d169f6816b77376283cce5beafdcfe5d3d5e3b98e8b358d67c34b954a04
- SSDEEP 768:6CEPutHjWpMgMwP9h5Ij7khsp/6JtEZwMXVtkUI3t3CXyEyk3VbNbqDvJ4oT1y:/q6CdsCOZwMX3k5dWyklh+Dvbw
- TLSH
  T19F43D4A0EE5C8D36499B52D9F48140DCB9BCC43191299CF3FCDDA12AF09CC6DA278676
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  Subway Surfers/Subway_Surfers_Data/Mono/etc/mono/2.0/machine.config
- Size 26KB
- SHA256 2d2fccb3f1afe931f7f4df289caf9fcfa31578b4fb4e1f610d3530832848e70a
- MD5 603173d56ace47a2d90b87ffbc3bfa91
- SHA1 889d20428d2f8a60f7aeead5d0da4009200e5365
- SHA512 7b8b8073ebae8a31605ab127e2549a013f59da5d4de0fba933aeca7119cfc937111e48a2354e41c794dc0082b6c08ad50724ae806fde8f95a946d55d2ebdb7f5
- SSDEEP 384:PbBtBtWR5RwRqrR2RN3RPfRaRvRyRaRIKbX/yeRpQXWBnj3g:DuU
- TLSH
  T1DCC2F0703609BDAE494227235C54FA8046BF57196BA86C0CB5FF622CFD2688BD3132D7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral27 behavioral28
- Target
  Subway Surfers/Subway_Surfers_Data/Mono/etc/mono/2.0/settings.map
- Size 2KB
- SHA256 ca89036b7d7f1ae9311a6a2fbcf05fc5b997bd43fd21dd54e11c18018ef65f08
- MD5 55dac562878b7dd98ee8a7ad203a26e6
- SHA1 d16baa15e7d3042bcf9d7318209c696f4daf2cb0
- SHA512 987c5cd86a9825953de670e5c15404694feb15cd5fa9afa8af4c2d5bda9d805839c9695d44122b32e0ffafe08d720c3df58000e89c8822fd9a5eb28eaf2ad478
- TLSH
  T1BB511138F344B5F50782052EA45B95D243B6053FA77A499C31ACD13D6F2984B83B32DD
- MD5 SHA1 SHA512 TLSH
Score

3^/10

adware discovery spyware
behavioral29 behavioral30
- Target
  Subway Surfers/Subway_Surfers_Data/Mono/etc/mono/2.0/web.config
- Size 11KB
- SHA256 3c1a76a5849074b437d297656a208a3bef6d84b982153542b9c797046c601dfc
- MD5 2b6303c4f12762b71051db6e947f90a4
- SHA1 a4d7e05516f63d6ab67327b299d4fb2852cb840b
- SHA512 80f5da60654e1851ef21526e434b32d94e18883a08bacbbaa0e1f85b80469c46510b6ddb9b429f16cc4be89c6f2bb2627bbae9cb1d0c7e45b665efb7721c6d86
- SSDEEP 192:wcedeaZ0sEMYaWN5bs6yyzEVkEYEG/Z1f5v6CuCCrtQzPwkP/waeKjy:wj5YaWPs6/1zwya
- TLSH
  T1FE32BD34171DEDDD8B9066530420ABE162BF9B5A2744CD4CF1EF2329EB5548BE3611E3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Family: Floxif, Floodfix

Detects Floxif payload

Event Triggered Execution: AppInit DLLs

ACProtect 1.3x - 1.4x DLL software

Loads dropped DLL

Drops desktop.ini file(s)

Enumerates connected drives

UPX packed file

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32