floxif | 700ac677ccae076a5e19db3f68a34f002fdbb6fb4d40fe13a7e7de31a53baa45

General

Target
2026-06-04_1dcb01f60952d0821bf8d887a47ecc75_elex_emotet_floxif_icedid_remcos
Size 3.3MB
Sample260604-p3fp4aez4y
SHA256 700ac677ccae076a5e19db3f68a34f002fdbb6fb4d40fe13a7e7de31a53baa45
MD5 1dcb01f60952d0821bf8d887a47ecc75
SHA1 f9dd679fba6b01f10833f62ed7fabb1eb6d72103
SHA512 b995656a9e4e617425f7025cb36fd9286beb7e4e76b846fc2536e41edca3d2f42392594205e494658807f009a516c283f90afb682e3ffe76c2e29003017eab2e
SSDEEP 49152:jtaLZd5KAxBtFNPBN3N+rwItb9ig2ZPV/yiwbRoNrQ4:joLZd5KAxrFNZN3NUwItb9iNPV/yuU4
TLSH
T1D0F55912AE8DC476D6591030DBA96FFA5134AD44FB2946837231FE3FFC323D2656620A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-06-04_1dcb01f60952d0821bf8d887a47ecc75_elex_emotet_floxif_icedid_remcos
- Size 3.3MB
- SHA256 700ac677ccae076a5e19db3f68a34f002fdbb6fb4d40fe13a7e7de31a53baa45
- MD5 1dcb01f60952d0821bf8d887a47ecc75
- SHA1 f9dd679fba6b01f10833f62ed7fabb1eb6d72103
- SHA512 b995656a9e4e617425f7025cb36fd9286beb7e4e76b846fc2536e41edca3d2f42392594205e494658807f009a516c283f90afb682e3ffe76c2e29003017eab2e
- SSDEEP 49152:jtaLZd5KAxBtFNPBN3N+rwItb9ig2ZPV/yiwbRoNrQ4:joLZd5KAxrFNZN3NUwItb9iNPV/yuU4
- TLSH
  T1D0F55912AE8DC476D6591030DBA96FFA5134AD44FB2946837231FE3FFC323D2656620A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

adware backdoor defense_evasion discovery floxif persistence privilege_escalation spyware stealer trojan upx
- Family: Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Detects Floxif payload
  backdoor
- UPX dump on OEP (original entry point)
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  defense_evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2