floxif | d0c40c1efc722f0c925812da6cd5fca04dcc446b3b6ff2b088ce98dc365787ff

General

Target
2026-07-14_bbc1b6bfe273204d600f198632eff191_coinminer_darkgate_elex_floxif_graphican_mafia_remcos
Size 2.0MB
Sample260714-twz8dagv2m
SHA256 d0c40c1efc722f0c925812da6cd5fca04dcc446b3b6ff2b088ce98dc365787ff
MD5 bbc1b6bfe273204d600f198632eff191
SHA1 3ec44953df7d6adee9833cbe82d46f0b554d4f0c
SHA512 14c640d45f70ceea4d0ea7be9046a41d29e405e5aadcb16ee3422ea1b5506841ea097e765e3724cddba9440e7ed922adbc32eeec9dd9fc9c9d76107ef838311e
SSDEEP 49152:3X1LGMMeY2vV5oRwQf5C+QbN1p4im7Ykf2Aadx1Tqp7X6NzOZSY6TNmIntoG:3X1LGMMeY2MRd5C+yN1p4PV+Aadx1Tqu
TLSH
T1BB959E21FA91C077C172323099DDA3B9B6E99E705F75028756D02E3E2E744D36A2872F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-14_bbc1b6bfe273204d600f198632eff191_coinminer_darkgate_elex_floxif_graphican_mafia_remcos
- Size 2.0MB
- SHA256 d0c40c1efc722f0c925812da6cd5fca04dcc446b3b6ff2b088ce98dc365787ff
- MD5 bbc1b6bfe273204d600f198632eff191
- SHA1 3ec44953df7d6adee9833cbe82d46f0b554d4f0c
- SHA512 14c640d45f70ceea4d0ea7be9046a41d29e405e5aadcb16ee3422ea1b5506841ea097e765e3724cddba9440e7ed922adbc32eeec9dd9fc9c9d76107ef838311e
- SSDEEP 49152:3X1LGMMeY2vV5oRwQf5C+QbN1p4im7Ykf2Aadx1Tqp7X6NzOZSY6TNmIntoG:3X1LGMMeY2MRd5C+yN1p4PV+Aadx1Tqu
- TLSH
  T1BB959E21FA91C077C172323099DDA3B9B6E99E705F75028756D02E3E2E744D36A2872F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor discovery floxif persistence privilege_escalation trojan upx
- Family: Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Detects Floxif payload
  backdoor
- UPX dump on OEP (original entry point)
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2