floxif | ea72179f120f39e9ee04c66ce0f05f27ffa837c399311307014f05a76541d632

General

Target
2026-04-23_99297c0c1c9670b4572926366cfd08e0_amadey_coinminer_elex_floxif_smoke-loader.exe
Size 6.9MB
Sample260423-txlflsay41
SHA256 ea72179f120f39e9ee04c66ce0f05f27ffa837c399311307014f05a76541d632
MD5 99297c0c1c9670b4572926366cfd08e0
SHA1 ec1490f2781aa0e1a3aa01f6fdd85552ec957b14
SHA512 4e04ae49b62ec5eeeb6eaa5dbaf29cd5be1bfde3e9b203ff55a2e9cb1661da293ede0f67820cffd382be4558b2cd7c0245af434877fc97430edd399010cc23ae
SSDEEP 196608:+PbMcp4zKAKpCPhD5nsF5GBAiSG5VtJFeHt:MMcAWKJsF5vib5VtTeN
TLSH
T11376333296685327D1F20973F814E2207D78B13D2F1104A3A794EEAD2DAD5A766FB307
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery floxif trojan upx

Malware Config

Signatures

Family: Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
backdoor trojan floxif

Detects Floxif payload 1 IoCs

backdoor

resource	yara_rule
behavioral2/files/0x002400000002b231-1.dat	floxif

UPX dump on OEP (original entry point) 5 IoCs

resource	yara_rule
behavioral2/files/0x002400000002b231-1.dat	UPX
behavioral2/memory/3048-3-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/3048-12-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/3048-17-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/3048-20-0x0000000010000000-0x0000000010030000-memory.dmp	UPX

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x002400000002b231-1.dat	acprotect

Loads dropped DLL 1 IoCs

pid	Process
3048	2026-04-23_99297c0c1c9670b4572926366cfd08e0_amadey_coinminer_elex_floxif_smoke-loader.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\e:	2026-04-23_99297c0c1c9670b4572926366cfd08e0_amadey_coinminer_elex_floxif_smoke-loader.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x002400000002b231-1.dat	upx
behavioral2/memory/3048-3-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/3048-12-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/3048-17-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/3048-20-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\symsrv.dll	2026-04-23_99297c0c1c9670b4572926366cfd08e0_amadey_coinminer_elex_floxif_smoke-loader.exe
File created	\??\c:\program files\common files\system\symsrv.dll.000	2026-04-23_99297c0c1c9670b4572926366cfd08e0_amadey_coinminer_elex_floxif_smoke-loader.exe

Program crash 14 IoCs

pid	pid_target	Process	procid_target
5064	3048	WerFault.exe	80
5016	3048	WerFault.exe	80
4608	3048	WerFault.exe	80
1680	3048	WerFault.exe	80
1264	3048	WerFault.exe	80
5096	3048	WerFault.exe	80
4776	3048	WerFault.exe	80
2980	3048	WerFault.exe	80
3200	3048	WerFault.exe	80
2756	3048	WerFault.exe	80
232	3048	WerFault.exe	80
4100	3048	WerFault.exe	80
4688	3048	WerFault.exe	80
1820	3048	WerFault.exe	80

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-23_99297c0c1c9670b4572926366cfd08e0_amadey_coinminer_elex_floxif_smoke-loader.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3048	2026-04-23_99297c0c1c9670b4572926366cfd08e0_amadey_coinminer_elex_floxif_smoke-loader.exe
3048	2026-04-23_99297c0c1c9670b4572926366cfd08e0_amadey_coinminer_elex_floxif_smoke-loader.exe
3048	2026-04-23_99297c0c1c9670b4572926366cfd08e0_amadey_coinminer_elex_floxif_smoke-loader.exe
3048	2026-04-23_99297c0c1c9670b4572926366cfd08e0_amadey_coinminer_elex_floxif_smoke-loader.exe
3048	2026-04-23_99297c0c1c9670b4572926366cfd08e0_amadey_coinminer_elex_floxif_smoke-loader.exe
3048	2026-04-23_99297c0c1c9670b4572926366cfd08e0_amadey_coinminer_elex_floxif_smoke-loader.exe
3048	2026-04-23_99297c0c1c9670b4572926366cfd08e0_amadey_coinminer_elex_floxif_smoke-loader.exe
3048	2026-04-23_99297c0c1c9670b4572926366cfd08e0_amadey_coinminer_elex_floxif_smoke-loader.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3048	2026-04-23_99297c0c1c9670b4572926366cfd08e0_amadey_coinminer_elex_floxif_smoke-loader.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 4760	3048	2026-04-23_99297c0c1c9670b4572926366cfd08e0_amadey_coinminer_elex_floxif_smoke-loader.exe	92

C:\Users\Admin\AppData\Local\Temp\2026-04-23_99297c0c1c9670b4572926366cfd08e0_amadey_coinminer_elex_floxif_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-23_99297c0c1c9670b4572926366cfd08e0_amadey_coinminer_elex_floxif_smoke-loader.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3048 -s 520
  2⤵
  - Program crash
  PID:5064
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3048 -s 564
  2⤵
  - Program crash
  PID:5016
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3048 -s 596
  2⤵
  - Program crash
  PID:4608
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3048 -s 680
  2⤵
  - Program crash
  PID:1680
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3048 -s 676
  2⤵
  - Program crash
  PID:1264
- C:\Users\Admin\AppData\Local\Temp\2026-04-23_99297c0c1c9670b4572926366cfd08e0_amadey_coinminer_elex_floxif_smoke-loader.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-04-23_99297c0c1c9670b4572926366cfd08e0_amadey_coinminer_elex_floxif_smoke-loader.exe" -burn.unelevated BurnPipe.{5F05EADB-D935-4D89-83CD-0E3B7B1C1F6B} {5D59F3B2-06C7-4560-8055-C0E91216016E} 3048
  2⤵
  PID:4760
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3048 -s 832
  2⤵
  - Program crash
  PID:5096
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3048 -s 916
  2⤵
  - Program crash
  PID:4776
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3048 -s 840
  2⤵
  - Program crash
  PID:2980
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3048 -s 956
  2⤵
  - Program crash
  PID:3200
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3048 -s 1140
  2⤵
  - Program crash
  PID:2756
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3048 -s 796
  2⤵
  - Program crash
  PID:232
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3048 -s 1356
  2⤵
  - Program crash
  PID:4100
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3048 -s 924
  2⤵
  - Program crash
  PID:4688
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3048 -s 1604
  2⤵
  - Program crash
  PID:1820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3048 -ip 3048
1⤵
PID:1836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 3048 -ip 3048
1⤵
PID:3420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 3048 -ip 3048
1⤵
PID:3988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 3048 -ip 3048
1⤵
PID:1972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3048 -ip 3048
1⤵
PID:3472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3048 -ip 3048
1⤵
PID:3208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3048 -ip 3048
1⤵
PID:1124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3048 -ip 3048
1⤵
PID:3344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3048 -ip 3048
1⤵
PID:908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3048 -ip 3048
1⤵
PID:2904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3048 -ip 3048
1⤵
PID:336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3048 -ip 3048
1⤵
PID:4476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3048 -ip 3048
1⤵
PID:836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3048 -ip 3048
1⤵
PID:4016

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

symsrv.dll

Path C:\Program Files\Common Files\System\symsrv.dll
Size 67KB
SHA256 de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
MD5 7574cf2c64f35161ab1292e2f532aabf
SHA1 14ba3fa927a06224dfe587014299e834def4644f
SHA512 4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab
SSDEEP 1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7ZL:c8y93KQjy7G55riF1cMo03V
TLSH
T17863F1372AB5807DDD210D37949F835AB771E5A76C20643FC25907D988B8DD0E3239AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

symsrv.dll.000

Path C:\Program Files\Common Files\System\symsrv.dll.000
Size 114B
SHA256 aefc503b1ed462d7b6280228a7b5b710792273b78934426f88325341ac5b5a92
MD5 e609411db8aa6775d0344c75c23ae79b
SHA1 1d2ff6194bf159ce36cd0461cd3da29486d1e97d
SHA512 6884ff5c07bc687132c965a59cb8c5a898a25da74c6c846c1d6089ddca8007cb7e4d2f8520bdce9fbcf6e2f9c9e5c28d8c8d6d049d3522470bdc7d38bbfa0ad0
TLSH
T1FFB09262AA2791EAE1AA224505A0248C1ED0B62AB48638002EBA5A4E93256A85916147
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3048-3-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/3048-11-0x0000000000A60000-0x0000000000AC5000-memory.dmp

Download

memory/3048-12-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/3048-17-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/3048-20-0x0000000010000000-0x0000000010030000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads