floxif | 6b5b03ac222cc1837b09c273b7ace2c2d21d1335b374aea1405dd13ac7bc9885

General

Target
2026-06-04_19b7b4c767da1b89eb3156fde9041205_amadey_coinminer_elex_floxif_helldown_icedid_manuscrypt_rhadamanthys_smoke-loader_stop
Size 4.5MB
Sample260604-sdggwag171
SHA256 6b5b03ac222cc1837b09c273b7ace2c2d21d1335b374aea1405dd13ac7bc9885
MD5 19b7b4c767da1b89eb3156fde9041205
SHA1 0e3da846eb07cf406c650554d610330c83375a0a
SHA512 fae270a4e34fa85509e6d58fff9fbdc4db472b3b1d8db947ddf53b9c21e0bc263a600d7b3d9c7931ba92a20a79878b2b9c5c6092935e2c6ea24bae5854b5b478
SSDEEP 49152:CxggVlbv6UtdwuAqdeD6x7EOTrODhJf85pdY9CNwuAqdeD6x7EOTrODhJf/RiVuI:CJVlbvHtdvAcl5pdvNvAcoRiMAb
TLSH
T16B26AE41BBC281F5D45385359197C73BAA76FD241724A3CB9BA07E629C723E18E3C34A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-06-04_19b7b4c767da1b89eb3156fde9041205_amadey_coinminer_elex_floxif_helldown_icedid_manuscrypt_rhadamanthys_smoke-loader_stop
- Size 4.5MB
- SHA256 6b5b03ac222cc1837b09c273b7ace2c2d21d1335b374aea1405dd13ac7bc9885
- MD5 19b7b4c767da1b89eb3156fde9041205
- SHA1 0e3da846eb07cf406c650554d610330c83375a0a
- SHA512 fae270a4e34fa85509e6d58fff9fbdc4db472b3b1d8db947ddf53b9c21e0bc263a600d7b3d9c7931ba92a20a79878b2b9c5c6092935e2c6ea24bae5854b5b478
- SSDEEP 49152:CxggVlbv6UtdwuAqdeD6x7EOTrODhJf85pdY9CNwuAqdeD6x7EOTrODhJf/RiVuI:CJVlbvHtdvAcl5pdvNvAcoRiMAb
- TLSH
  T16B26AE41BBC281F5D45385359197C73BAA76FD241724A3CB9BA07E629C723E18E3C34A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor discovery floxif trojan upx persistence privilege_escalation
- Family: Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Detects Floxif payload
  backdoor
- Custom signature
  
  UPX dump on OEP (original entry point)
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2