floxif | 9cfc193bb1cd7e47285fb964f9a176cef9f4a49fbfcdc030216f6f79e926886b

General

Target
2026-06-25_5a95485f971dd66265de7df9b8a92048_amadey_elex_floxif_smoke-loader
Size 646KB
Sample260629-15mrzagv4s
SHA256 9cfc193bb1cd7e47285fb964f9a176cef9f4a49fbfcdc030216f6f79e926886b
MD5 5a95485f971dd66265de7df9b8a92048
SHA1 3d2732c5bb107ba2c0ae818aabb33bf635e6a353
SHA512 97574defd6e709c19f1b3197aad9e5a26503318167113877aec345338d5637f1a2d4073d033c4abe050809ecc6d042fddf755e42e00bfa7fbabc8b6c17926aeb
SSDEEP 12288:SqAGKh0UJfUY51d9ca9dWpeV69X8gfKg4vCb4B4BjvrEH7a:Rsh0URUY5Ga9Ip069tKxsjrEH7a
TLSH
T12DE4BF22B1D296BBD5B530B1265A26105AF6DC3809398C9797C11E0D6B6CDF3EF29333
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-06-25_5a95485f971dd66265de7df9b8a92048_amadey_elex_floxif_smoke-loader
- Size 646KB
- SHA256 9cfc193bb1cd7e47285fb964f9a176cef9f4a49fbfcdc030216f6f79e926886b
- MD5 5a95485f971dd66265de7df9b8a92048
- SHA1 3d2732c5bb107ba2c0ae818aabb33bf635e6a353
- SHA512 97574defd6e709c19f1b3197aad9e5a26503318167113877aec345338d5637f1a2d4073d033c4abe050809ecc6d042fddf755e42e00bfa7fbabc8b6c17926aeb
- SSDEEP 12288:SqAGKh0UJfUY51d9ca9dWpeV69X8gfKg4vCb4B4BjvrEH7a:Rsh0URUY5Ga9Ip069tKxsjrEH7a
- TLSH
  T12DE4BF22B1D296BBD5B530B1265A26105AF6DC3809398C9797C11E0D6B6CDF3EF29333
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor discovery floxif persistence privilege_escalation trojan upx adware spyware
- Family: Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Detects Floxif payload
  backdoor
- UPX dump on OEP (original entry point)
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2