General
- Target 2026-05-28_02d2fc5ce562514f01c0e0febeb7b5a4_elex_floxif_wannacry
- Size 28.7MB
- Sample260528-prskhsfx2p
- SHA256 0e6759d90d89033d122dc5cd2bd234b8fdc54c40b3ebc4bf0d4d876e96e59df0
Malware Config
Targets
-
- Target 2026-05-28_02d2fc5ce562514f01c0e0febeb7b5a4_elex_floxif_wannacry
- Size 28.7MB
- SHA256 0e6759d90d89033d122dc5cd2bd234b8fdc54c40b3ebc4bf0d4d876e96e59df0
Score10/10Family: Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
Detects Floxif payload
- Custom signature
UPX dump on OEP (original entry point)
Event Triggered Execution: AppInit DLLs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Loads dropped DLL
Adds Run key to start application
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
Drops file in System32 directory
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1AppInit DLLs
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1AppInit DLLs
1