floxif | 9d7f16466744aeef804e12cd816cc0b7e5d2ed130779d173befe10fcf5654f41

General

Target
2026-07-22_cd74acfe000d403fdd22bf290a8c1aec_amadey_coinminer_elex_floxif_graphican_hijackloader_luca-stealer_lynx_njrat
Size 3.1MB
Sample260722-xwf2aabb46
SHA256 9d7f16466744aeef804e12cd816cc0b7e5d2ed130779d173befe10fcf5654f41
MD5 cd74acfe000d403fdd22bf290a8c1aec
SHA1 5143e2eafb96bed1bc52097e8c7db48735225789
SHA512 9eaccc302bccc8e335af7ca1351f7d86de86ab1a39f8c93c04c69e31facf4647edd82fcab8431d723d434bd861e63e03ac061ee7c980827eb3669c47398cb016
SSDEEP 49152:xYJY1LxZGc8VLFWDD+lRYWwdb6lpC/1URz4ScPgDffhPgxTxzwNT+u5fXE41zx1:mY118VOgVyqc1In5ffhP35XJ
TLSH
T147E59E93F2C583B2D9C250303867773BCE36B43A8A759ACBA7801D57D831991E636F46
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-22_cd74acfe000d403fdd22bf290a8c1aec_amadey_coinminer_elex_floxif_graphican_hijackloader_luca-stealer_lynx_njrat
- Size 3.1MB
- SHA256 9d7f16466744aeef804e12cd816cc0b7e5d2ed130779d173befe10fcf5654f41
- MD5 cd74acfe000d403fdd22bf290a8c1aec
- SHA1 5143e2eafb96bed1bc52097e8c7db48735225789
- SHA512 9eaccc302bccc8e335af7ca1351f7d86de86ab1a39f8c93c04c69e31facf4647edd82fcab8431d723d434bd861e63e03ac061ee7c980827eb3669c47398cb016
- SSDEEP 49152:xYJY1LxZGc8VLFWDD+lRYWwdb6lpC/1URz4ScPgDffhPgxTxzwNT+u5fXE41zx1:mY118VOgVyqc1In5ffhP35XJ
- TLSH
  T147E59E93F2C583B2D9C250303867773BCE36B43A8A759ACBA7801D57D831991E636F46
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor discovery floxif trojan upx persistence privilege_escalation
- Family: Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Detects Floxif payload
  backdoor
- UPX dump on OEP (original entry point)
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2