General
- Target fafaf6b989761eee2a04bcf1602fb9125dbbea16a305edc1fde73cddd0915277
- Size 3.4MB
- Sample261012-s2zy5ags9k
- SHA256 fafaf6b989761eee2a04bcf1602fb9125dbbea16a305edc1fde73cddd0915277
Malware Config
Targets
-
- Target fafaf6b989761eee2a04bcf1602fb9125dbbea16a305edc1fde73cddd0915277
- Size 3.4MB
- SHA256 fafaf6b989761eee2a04bcf1602fb9125dbbea16a305edc1fde73cddd0915277
Score10/10-
Family: Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
-
Detects Floxif payload
-
Event Triggered Execution: AppInit DLLs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
Deletes itself
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE
-
Loads dropped DLL
-
Modifies system executable filetype association
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
MITRE ATT&CK Enterprise v16
Persistence
Event Triggered Execution
3AppInit DLLs
1Change Default File Association
1Component Object Model Hijacking
1Privilege Escalation
Event Triggered Execution
3AppInit DLLs
1Change Default File Association
1Component Object Model Hijacking
1