floxif | 35008892b56d968549b02d4c781763ecd50ad2360bd3b0eecc2f132e6f1b7870

General

Target
2026-06-26_f2eb304940dffdbc462f2aea6a37080b_elex_floxif_glassworm_mafia_remcos
Size 1.9MB
Sample260629-m7jlfadw2m
SHA256 35008892b56d968549b02d4c781763ecd50ad2360bd3b0eecc2f132e6f1b7870
MD5 f2eb304940dffdbc462f2aea6a37080b
SHA1 e8495fe89c49e937666c90cd7a6952583efe25fa
SHA512 c90e44431e2333edb4a3a4ce8a12bf4b7f2fa3009f15fced125ae640f047bef2c935f4f7e57bd48b58ab0eb5979b0c877dc7539ea3d42819c070e47c8c12327a
SSDEEP 49152:U0mIRUlhR785E/EaRyHCMKvYZjzPLmi6ImhITXjsIDBe66hc1/e9ceq:U0mIRUlTTY9zPt6ImhZCBeG
TLSH
T1CD955B36E2C0926BE4A361F8EA7A03746DA5ACB5733700CBD1C16F1E67B25C36234756
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-06-26_f2eb304940dffdbc462f2aea6a37080b_elex_floxif_glassworm_mafia_remcos
- Size 1.9MB
- SHA256 35008892b56d968549b02d4c781763ecd50ad2360bd3b0eecc2f132e6f1b7870
- MD5 f2eb304940dffdbc462f2aea6a37080b
- SHA1 e8495fe89c49e937666c90cd7a6952583efe25fa
- SHA512 c90e44431e2333edb4a3a4ce8a12bf4b7f2fa3009f15fced125ae640f047bef2c935f4f7e57bd48b58ab0eb5979b0c877dc7539ea3d42819c070e47c8c12327a
- SSDEEP 49152:U0mIRUlhR785E/EaRyHCMKvYZjzPLmi6ImhITXjsIDBe66hc1/e9ceq:U0mIRUlTTY9zPt6ImhZCBeG
- TLSH
  T1CD955B36E2C0926BE4A361F8EA7A03746DA5ACB5733700CBD1C16F1E67B25C36234756
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor discovery floxif trojan upx adware persistence privilege_escalation ransomware spyware
- Family: Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Detects Floxif payload
  backdoor
- UPX dump on OEP (original entry point)
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2