Family: Floxif, Floodfix

Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.

Detects Floxif payload

UPX dump on OEP (original entry point)

Badlisted process makes network request

Network request originating from process or tool commonly abused by malware.

Drops file in Drivers directory

Event Triggered Execution: AppInit DLLs

Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

Manipulates Digital Signatures

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

Modifies Windows Firewall