floxif | 66ec33bd985db904c922699e5615c54e52598723cd299fa233d169fed87d5d30

General

Target
2026-07-01_c4fcf2e8cbfc970424d41f8e7d7839bf_coinminer_darkgate_elex_floxif_rhadamanthys_stop
Size 2.9MB
Sample260701-r943daav2y
SHA256 66ec33bd985db904c922699e5615c54e52598723cd299fa233d169fed87d5d30
MD5 c4fcf2e8cbfc970424d41f8e7d7839bf
SHA1 59e532f4064f3feed5a85c08005d262b4f4cbc48
SHA512 23b270e5fcd7e10d15cf6fab3cd098abcd09b93c74fdc263c38b718d13f38998fc287787e2ae102c740e631b6fc81ebd411d0c0ba10457a756e3ff8b41f7ecae
SSDEEP 49152:ZJWRyd67xNuD4yyU9wLKUoiTs78CSXfLfikMVA2GMoEsa7imQMdNlEHMf:Cyd674wLKU/Ts4Cm2kMVToEsa7imQMvZ
TLSH
T16BE5AF613B82C07BD2222C329969A77962E5FD610F3946C726803F397D355C2AD3DE1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-01_c4fcf2e8cbfc970424d41f8e7d7839bf_coinminer_darkgate_elex_floxif_rhadamanthys_stop
- Size 2.9MB
- SHA256 66ec33bd985db904c922699e5615c54e52598723cd299fa233d169fed87d5d30
- MD5 c4fcf2e8cbfc970424d41f8e7d7839bf
- SHA1 59e532f4064f3feed5a85c08005d262b4f4cbc48
- SHA512 23b270e5fcd7e10d15cf6fab3cd098abcd09b93c74fdc263c38b718d13f38998fc287787e2ae102c740e631b6fc81ebd411d0c0ba10457a756e3ff8b41f7ecae
- SSDEEP 49152:ZJWRyd67xNuD4yyU9wLKUoiTs78CSXfLfikMVA2GMoEsa7imQMdNlEHMf:Cyd674wLKU/Ts4Cm2kMVToEsa7imQMvZ
- TLSH
  T16BE5AF613B82C07BD2222C329969A77962E5FD610F3946C726803F397D355C2AD3DE1B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor discovery floxif trojan upx persistence privilege_escalation
- Family: Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Detects Floxif payload
  backdoor
- UPX dump on OEP (original entry point)
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2