floxif | 589e7dffa8f47c010725522064323128c10e040752b81b45dca170a38a66968d

General

Target
2026-07-09_1f3211bc87662647bc5e1deb67a77c51_amadey_coinminer_elex_floxif_glassworm_hijackloader_remcos_smoke-loader
Size 8.2MB
Sample260709-sdj8rscv9j
SHA256 589e7dffa8f47c010725522064323128c10e040752b81b45dca170a38a66968d
MD5 1f3211bc87662647bc5e1deb67a77c51
SHA1 6ec60fce90d166183fc8cbf864748ca5d8d31ac6
SHA512 38a94521302195f7d230a77de1551fa443cf6d9efb6ae08bb0ea36bc7435062d15ae24e962f9f1c3250b9e8d77858f864ca5b2d7965253568a0cb3bc3696168b
SSDEEP 196608:2HCxz1vdwsSV6o3WD8fAo+VLrLVkavciwqB8p46qkC:2+plSf3BfAdVPqgciwK8Ns
TLSH
T17A86BF59F3934260CA42E6797F6DB2378E708F21E3530ED7F8985DCD12E2A8690B5319
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-09_1f3211bc87662647bc5e1deb67a77c51_amadey_coinminer_elex_floxif_glassworm_hijackloader_remcos_smoke-loader
- Size 8.2MB
- SHA256 589e7dffa8f47c010725522064323128c10e040752b81b45dca170a38a66968d
- MD5 1f3211bc87662647bc5e1deb67a77c51
- SHA1 6ec60fce90d166183fc8cbf864748ca5d8d31ac6
- SHA512 38a94521302195f7d230a77de1551fa443cf6d9efb6ae08bb0ea36bc7435062d15ae24e962f9f1c3250b9e8d77858f864ca5b2d7965253568a0cb3bc3696168b
- SSDEEP 196608:2HCxz1vdwsSV6o3WD8fAo+VLrLVkavciwqB8p46qkC:2+plSf3BfAdVPqgciwK8Ns
- TLSH
  T17A86BF59F3934260CA42E6797F6DB2378E708F21E3530ED7F8985DCD12E2A8690B5319
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor discovery floxif trojan upx persistence privilege_escalation
- Family: Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Detects Floxif payload
  backdoor
- UPX dump on OEP (original entry point)
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2