General
- Target scan
- Size 5KB
- Sample261016-zzy3daw14m
- SHA256 8d84bf82150c8a42ef6643ab6c0f4fdb181c85f89adaa14f9821ce4f121889dd
Score
10/10
Malware Config
Targets
-
- Target scan
- Size 5KB
- SHA256 8d84bf82150c8a42ef6643ab6c0f4fdb181c85f89adaa14f9821ce4f121889dd
Score10/10-
Family: Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
-
Detects Floxif payload
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Downloads MZ/PE file
-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
Executes dropped EXE
-
Loads dropped DLL
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Probable phishing domain
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
MITRE ATT&CK Enterprise v16
Defense Evasion
Modify Registry
2Subvert Trust Controls
1SIP and Trust Provider Hijacking
1