Queries/

Check for artifacts of the Floxif trojan

Babatunde Micheal Okutubo

Checks for artifacts from the Floxif trojan on Windows machines.

To learn more about queries, check this guide.

Query PowerShellNEW BashNEW

SELECT * FROM registry WHERE path LIKE 'HKEY_LOCAL_MACHINE\\SOFTWARE\\Piriform\\Agomo%';

$base = "HKLM:\SOFTWARE\Piriform"
$searchPrefix = "HKEY_LOCAL_MACHINE\SOFTWARE\Piriform\Agomo"

# Recursively get all registry keys under the base path
Get-ChildItem -Path $base -Recurse | ForEach-Object {
    if ($_.Name -like "$searchPrefix*") {
        # Open the registry key to enumerate its values.
        $regKey = Get-Item -LiteralPath $_.PSPath
        $valueNames = $regKey.GetValueNames()
        foreach ($valName in $valueNames) {
            $valData = $regKey.GetValue($valName)
            $valType = $regKey.GetValueKind($valName)
            if ($valName -eq "") {
                $nameDisplay = "(Default)"
            }
            else {
                $nameDisplay = $valName
            }
            Write-Output "Path: $($_.Name) | Name: $nameDisplay | Type: $valType | Data: $valData"
        }
    }
}