floxif | 03148f7d886c4bb41011b042e82104a3ae77839e762c28e8bb9e38417fee4ac0

General

Target
2026-07-20_e32aa24db7bdd9c539f5b7e6de008256_elex_floxif_mimic_pay2key_wannacry
Size 1.1MB
Sample260720-gc2wmsav7y
SHA256 03148f7d886c4bb41011b042e82104a3ae77839e762c28e8bb9e38417fee4ac0
MD5 e32aa24db7bdd9c539f5b7e6de008256
SHA1 8c8a710a70ac98831ec877f7b0188e27375af4e9
SHA512 b03af4f12ad33f566698b9b46c95ed7c972d8373353c41ad150666b77dd371419574002a90f7b0926906679cdd46d64ed799630bba59fa46beb7870600349ebb
SSDEEP 24576:uX5rRsuLpKXjZB1Q1emzaCfkpoAw5+tWyCIGrdONeNrEH7+A:uNRLKXjZs9zaCMyr+8yCIGxONyA
TLSH
T1B035234077E9C7FCD0610632B51A2A9699E6CA7C0B0B85D7BB880E054F3E6C3D779687
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-20_e32aa24db7bdd9c539f5b7e6de008256_elex_floxif_mimic_pay2key_wannacry
- Size 1.1MB
- SHA256 03148f7d886c4bb41011b042e82104a3ae77839e762c28e8bb9e38417fee4ac0
- MD5 e32aa24db7bdd9c539f5b7e6de008256
- SHA1 8c8a710a70ac98831ec877f7b0188e27375af4e9
- SHA512 b03af4f12ad33f566698b9b46c95ed7c972d8373353c41ad150666b77dd371419574002a90f7b0926906679cdd46d64ed799630bba59fa46beb7870600349ebb
- SSDEEP 24576:uX5rRsuLpKXjZB1Q1emzaCfkpoAw5+tWyCIGrdONeNrEH7+A:uNRLKXjZs9zaCMyr+8yCIGxONyA
- TLSH
  T1B035234077E9C7FCD0610632B51A2A9699E6CA7C0B0B85D7BB880E054F3E6C3D779687
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor bootkit defense_evasion discovery execution floxif persistence trojan upx
- Family: Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Detects Floxif payload
  backdoor
- UPX dump on OEP (original entry point)
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Hide Artifacts: Hidden Files and Directories
  defense_evasion
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2