floxif | 0cda691a948ddfc52ceebd7bd282c845c24c76a4624b510f27f22ec8687b82c6

General

Target
2026-05-23_7478f7a9355e5a98478de98f7e21b492_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz
Size 4.6MB
Sample260523-c2vreabv7q
SHA256 0cda691a948ddfc52ceebd7bd282c845c24c76a4624b510f27f22ec8687b82c6
MD5 7478f7a9355e5a98478de98f7e21b492
SHA1 8117f970cc52181a9d67675e6637a491b6db2a70
SHA512 7c76fbe0e4851dc1e694786f63f80a1de4649a0c5b1254a2433b63a5112da48d4924288b5ffa844f5ec47aa9f40fadbc74509bdced074aae9f8cd3fa2753e088
SSDEEP 98304:JVWRBt6AX2BnzhIue03T0Ji7nt/bNARMgR:vWN6C2xzhz9Ikt/c
TLSH
T1A926BE027BC4C035D7D604314C2B776853FBEEA04A7186B77398BA2D7A349D2A539B63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-05-23_7478f7a9355e5a98478de98f7e21b492_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz
- Size 4.6MB
- SHA256 0cda691a948ddfc52ceebd7bd282c845c24c76a4624b510f27f22ec8687b82c6
- MD5 7478f7a9355e5a98478de98f7e21b492
- SHA1 8117f970cc52181a9d67675e6637a491b6db2a70
- SHA512 7c76fbe0e4851dc1e694786f63f80a1de4649a0c5b1254a2433b63a5112da48d4924288b5ffa844f5ec47aa9f40fadbc74509bdced074aae9f8cd3fa2753e088
- SSDEEP 98304:JVWRBt6AX2BnzhIue03T0Ji7nt/bNARMgR:vWN6C2xzhz9Ikt/c
- TLSH
  T1A926BE027BC4C035D7D604314C2B776853FBEEA04A7186B77398BA2D7A349D2A539B63
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

adware backdoor defense_evasion discovery floxif spyware trojan upx persistence privilege_escalation
- Family: Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Detects Floxif payload
  backdoor
- Custom signature
  
  UPX dump on OEP (original entry point)
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Executes dropped EXE
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  defense_evasion
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2