floxif | ea51888de777f1e6727886bbfbb047f2dced8c5dd07333b2e6c719fa0e1022bf

General

Target
ea51888de777f1e6727886bbfbb047f2dced8c5dd07333b2e6c719fa0e1022bf
Size 829KB
Sample260830-2agsxaap8y
SHA256 ea51888de777f1e6727886bbfbb047f2dced8c5dd07333b2e6c719fa0e1022bf
MD5 c22d359a16b2345b9fc6ab4bf11fe952
SHA1 9aa12046331fee1aef4351cf797bc7a319cea51e
SHA512 efae3cc9af853f4018d0afd0d934f203efdbbd312f44e6bde26e1f3013d2fd54ef89225ee016aa50f3d53c51c432608a026203e3a1dca26f660011007d3890fd
SSDEEP 12288:DMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6uB75t9I1hBjvrEH7T:DnsJ39LyjbJkQFMhmC+6Or9CrEH7T
TLSH
T1BB059F32F2D18677D1321A3CAC5BA3A4582ABE552E38794E7BF52D4C4F3D68238152D3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Targets

- Target
  ea51888de777f1e6727886bbfbb047f2dced8c5dd07333b2e6c719fa0e1022bf
- Size 829KB
- SHA256 ea51888de777f1e6727886bbfbb047f2dced8c5dd07333b2e6c719fa0e1022bf
- MD5 c22d359a16b2345b9fc6ab4bf11fe952
- SHA1 9aa12046331fee1aef4351cf797bc7a319cea51e
- SHA512 efae3cc9af853f4018d0afd0d934f203efdbbd312f44e6bde26e1f3013d2fd54ef89225ee016aa50f3d53c51c432608a026203e3a1dca26f660011007d3890fd
- SSDEEP 12288:DMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6uB75t9I1hBjvrEH7T:DnsJ39LyjbJkQFMhmC+6Or9CrEH7T
- TLSH
  T1BB059F32F2D18677D1321A3CAC5BA3A4582ABE552E38794E7BF52D4C4F3D68238152D3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor discovery floxif xred persistence privilege_escalation trojan upx
- Family: Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Family: Xred
  Xred is backdoor written in Delphi.
  backdoor xred
- Detects Floxif payload
  backdoor
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1