Floxif Family Infection Sample Analysis

1 Overview

The sample releases the symsrv.dll module in the directory C:\Program Files\Common Files\System, where symsrv.dll is the main infection module. The sample writes this module into memory and begins scanning files and directories on the victim’s computer, infecting files outside of the %system%, %windows%, and %temp% folders to avoid infecting system files that could cause system instability. During the infection process, it downloads additional malicious module components from the attacker’s C2 server, but due to the C2 being inactive, further analysis of other malicious modules is not possible.

2 Mitigation Recommendations

● Install an intelligent terminal defense system and perform a full system virus scan.

3 Detailed Analysis

3.1 setup.exe Analysis

After executing the sample (759FAE966FE22FB00B8331AF36556513), it first loads the symsrv.dll module and then releases it into the Program Files\Common Files\System directory.

The DLL path is written into the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows registry key. Once a program loads, it will load the DLL specified in the AppInit_DLLs registry entry.

Once the DLL module is loaded, it begins to infect files.

3.2 symsrv.dll Analysis

The sample (98D56568C600383803D56B493B461BFA) is a DLL module. By examining the export table with PE tools, it is identified as an infectious virus of the F1oxif family.

After loading, the sample calls the GetSystemDirectoryA, GetWindowsDirectoryA, and GetTempPathA APIs to obtain the locations of the %system%, %windows%, and %temp% folders, thereby avoiding infection of files in these folders to prevent system shutdown issues.

It also initializes the C2 and some function addresses.

It then creates a mutex named “Global\SYS E0A9138”.

Subsequently, it performs privilege escalation. After escalation, it hooks the KiUserExceptionDispatcher function for anti-debugging, and hooks RegOpenKeyExA, RegOpenKeyExW to protect its own registry entries. It also hooks CredReadW, CreateServiceA, CreateServiceW, OpenServiceA, OpenServiceW, WinVerifyTrust, CreateFileW, ExitProcess, CreateProcessInternalW, MessageBoxTimeoutW, and WahReferenceContextByHandle functions for self-preservation and file infection.

It checks whether common antivirus software exists on the computer.

Finally, it uses a combination of CreateToolhelp32Snapshot, Process32First, and Process32Next APIs to obtain the process list, and uses CreateToolhelp32Snapshot, Module32First, and Module32Next APIs to obtain the module list from each process.

The sample checks against the previously obtained three folders: %system%, %windows%, and %temp%.

If the traversed module path is not located in any of the three folders mentioned above, the sample reads the file into memory, performs the infection, renames the original file with a “.dat” extension, sets the file attributes to system file and hidden, then writes the infected file from memory back to disk with the original filename, and finally calls MoveFileExA to set the original file for deletion on the next startup.

During the infection process, the sample requests to download the following files from C2 (hxxp://5isohu.com/, hxxp://www.aieov.com/): logo.gif, setup.exe, so.gif.

The following is the data traffic captured by wirsharp.

1247 54.990000 192.168.19.128 192.168.19.128 HTTP 133 HTTP/1.0 200 OK(image/gif)

Among them, logo.gif is executed after download.

Since both C2 servers are inactive and no related historical samples are associated, further analysis of subsequent payloads is not possible.