floxif | f17fb2b6b6d760b7ac6d123d77ac60f12cfb52a276f3fe86f891758b17174f54

General

Target
2026-07-06_41ce95dfd77f4104c7ba7b8380bfb9ce_darkgate_elex_floxif_smoke-loader
Size 2.0MB
Sample260706-t4abxsdw4m
SHA256 f17fb2b6b6d760b7ac6d123d77ac60f12cfb52a276f3fe86f891758b17174f54
MD5 41ce95dfd77f4104c7ba7b8380bfb9ce
SHA1 d3281e3a7c471b0b4a1faec5a5059ff49d55d203
SHA512 1d8a4668746beea5a8f3b7bee08b4d4a8c34ef5d28c0593d612a42600eaf9996b859afc701da2b30be15f89e714fbb48e5e76ad5549a9b52342b7c3f10393df2
SSDEEP 49152:jio6pWgA7G+ZDYolW9Y3OqkWXNc3lfF9LLPOTtBZ8rIy1cgD5jHmzN:jApW9GOTW9Y3OqkWXNc3lfFwtH8rIy1a
TLSH
T1A6A59F323690D0BBC1733631A54EA3B9B2A9AD704D75428B13953F3D6E70493992C7AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-06_41ce95dfd77f4104c7ba7b8380bfb9ce_darkgate_elex_floxif_smoke-loader
- Size 2.0MB
- SHA256 f17fb2b6b6d760b7ac6d123d77ac60f12cfb52a276f3fe86f891758b17174f54
- MD5 41ce95dfd77f4104c7ba7b8380bfb9ce
- SHA1 d3281e3a7c471b0b4a1faec5a5059ff49d55d203
- SHA512 1d8a4668746beea5a8f3b7bee08b4d4a8c34ef5d28c0593d612a42600eaf9996b859afc701da2b30be15f89e714fbb48e5e76ad5549a9b52342b7c3f10393df2
- SSDEEP 49152:jio6pWgA7G+ZDYolW9Y3OqkWXNc3lfF9LLPOTtBZ8rIy1cgD5jHmzN:jApW9GOTW9Y3OqkWXNc3lfFwtH8rIy1a
- TLSH
  T1A6A59F323690D0BBC1733631A54EA3B9B2A9AD704D75428B13953F3D6E70493992C7AF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor discovery floxif persistence privilege_escalation trojan upx adware ransomware spyware
- Family: Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Detects Floxif payload
  backdoor
- Custom signature
  
  UPX dump on OEP (original entry point)
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2