floxif | 1ab92b25945a06d532326a4585cd6e7b09444cd374d165f2e10417c99a0ece8d

General

Target
jaffacakes118_Virus.Win32.Pioneer.cz.7d8403acf965e91f7e218
Size 1.9MB
Sample261015-2ajx9set2q
SHA256 1ab92b25945a06d532326a4585cd6e7b09444cd374d165f2e10417c99a0ece8d
MD5 b306e25e2b17d8403acf965e91f7e218
SHA1 5b42e946be863877e4d4d482e9e16f63432355e9
SHA512 03ddc90b59db39bceb28af4d3c8b721fb80eeccccbddc90bc6392d2257f9e6b31a4df6708579008fe1a30217a1d105ba7935d70fa478f4656205c290d0762393
SSDEEP 24576:bk4aPlfTUYDrQOfseBC1+ZnoBzEgY5cfPtQE3WV9UKkjhmKiKSqSWLaPgIze7m2c:brU9T8ZDYWntr3WVaju4I3VGizeL+H
TLSH
T15995BE61FBCAC1F6CE4B12742065D72F9BF1832857352AE363902E8D59B72D1AC36319
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  jaffacakes118_Virus.Win32.Pioneer.cz.7d8403acf965e91f7e218
- Size 1.9MB
- SHA256 1ab92b25945a06d532326a4585cd6e7b09444cd374d165f2e10417c99a0ece8d
- MD5 b306e25e2b17d8403acf965e91f7e218
- SHA1 5b42e946be863877e4d4d482e9e16f63432355e9
- SHA512 03ddc90b59db39bceb28af4d3c8b721fb80eeccccbddc90bc6392d2257f9e6b31a4df6708579008fe1a30217a1d105ba7935d70fa478f4656205c290d0762393
- SSDEEP 24576:bk4aPlfTUYDrQOfseBC1+ZnoBzEgY5cfPtQE3WV9UKkjhmKiKSqSWLaPgIze7m2c:brU9T8ZDYWntr3WVaju4I3VGizeL+H
- TLSH
  T15995BE61FBCAC1F6CE4B12742065D72F9BF1832857352AE363902E8D59B72D1AC36319
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor discovery floxif persistence trojan upx privilege_escalation spyware stealer
- Family: Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Detects Floxif payload
  backdoor
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2