floxif | 0624022779b42f1aadf7d04b7b7a0389e294bdb639096dbdf153419a23e6b5b0

General

Target
2026-06-26_4cafdd330ac20c6548ce4876bc6e1fb3_elex_floxif_rhadamanthys_stealc_stop_tofsee
Size 239KB
Sample260629-tpy2qshv8v
SHA256 0624022779b42f1aadf7d04b7b7a0389e294bdb639096dbdf153419a23e6b5b0
MD5 4cafdd330ac20c6548ce4876bc6e1fb3
SHA1 82870084e66d09d5f7b70b90473373f08365e3ab
SHA512 0477c32bb28611af102d1d504ada98c7fdd625906dfd0bc89bc65360e4a2e6bb25d8539c816868113d7c433ffab01238f14e2d60149e3727942678d15a6500f8
SSDEEP 6144:/eHxabEuRnCuuLugBV+UdvrEFp7hKIrC9I:/mxabEuRCJLDBjvrEH7hrC9I
TLSH
T1E134AD2136E1C3FBE4561030798AD6B1AAF1BC3C0E6A8647B79527495F3CB53CB0D60A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-06-26_4cafdd330ac20c6548ce4876bc6e1fb3_elex_floxif_rhadamanthys_stealc_stop_tofsee
- Size 239KB
- SHA256 0624022779b42f1aadf7d04b7b7a0389e294bdb639096dbdf153419a23e6b5b0
- MD5 4cafdd330ac20c6548ce4876bc6e1fb3
- SHA1 82870084e66d09d5f7b70b90473373f08365e3ab
- SHA512 0477c32bb28611af102d1d504ada98c7fdd625906dfd0bc89bc65360e4a2e6bb25d8539c816868113d7c433ffab01238f14e2d60149e3727942678d15a6500f8
- SSDEEP 6144:/eHxabEuRnCuuLugBV+UdvrEFp7hKIrC9I:/mxabEuRCJLDBjvrEH7hrC9I
- TLSH
  T1E134AD2136E1C3FBE4561030798AD6B1AAF1BC3C0E6A8647B79527495F3CB53CB0D60A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor discovery floxif trojan upx adware persistence privilege_escalation spyware
- Family: Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Detects Floxif payload
  backdoor
- UPX dump on OEP (original entry point)
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2