floxif | 0de9d93e2ccf441334ed5ae5b70dfb05f305755471c96cd0c3b0ce323b48bc0d

General

Target
2026-05-11_40a94c6facbc9fbb027b2fcbeb0e3865_bkransomware_darkgate_elex_floxif_maze
Size 2.1MB
Sample260511-sp1pwsds4v
SHA256 0de9d93e2ccf441334ed5ae5b70dfb05f305755471c96cd0c3b0ce323b48bc0d
MD5 40a94c6facbc9fbb027b2fcbeb0e3865
SHA1 3cbc0bfed565bd60b1bb49b5f8c24bd74f4a763c
SHA512 d4a7c7e2dcc56f3a2ada8059c1501ef1057330990d86d3ecfd93fb1dd7d32811d9c925fb2e3e188a5416662e017977983fdcdabcefcf0686511786957954c2d0
SSDEEP 49152:8knd6+gONTPp/3Mk9tkSo20kTFztamZEAbNUVNV53gtDofEKLVh+NADQwQa:Bd6+/TPp/3MkMSnjTRtamKYNUVNV53gE
TLSH
T1E3A59F2276A1807BD6731B30595E7328A2FDBD715E7642BB13902F2D2E70583D638B63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-05-11_40a94c6facbc9fbb027b2fcbeb0e3865_bkransomware_darkgate_elex_floxif_maze
- Size 2.1MB
- SHA256 0de9d93e2ccf441334ed5ae5b70dfb05f305755471c96cd0c3b0ce323b48bc0d
- MD5 40a94c6facbc9fbb027b2fcbeb0e3865
- SHA1 3cbc0bfed565bd60b1bb49b5f8c24bd74f4a763c
- SHA512 d4a7c7e2dcc56f3a2ada8059c1501ef1057330990d86d3ecfd93fb1dd7d32811d9c925fb2e3e188a5416662e017977983fdcdabcefcf0686511786957954c2d0
- SSDEEP 49152:8knd6+gONTPp/3Mk9tkSo20kTFztamZEAbNUVNV53gtDofEKLVh+NADQwQa:Bd6+/TPp/3MkMSnjTRtamKYNUVNV53gE
- TLSH
  T1E3A59F2276A1807BD6731B30595E7328A2FDBD715E7642BB13902F2D2E70583D638B63
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor discovery floxif trojan upx persistence privilege_escalation
- Family: Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Detects Floxif payload
  backdoor
- Custom signature
  
  UPX dump on OEP (original entry point)
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2