floxif | f40e14257c6f48cdc827d8a63c2b9ad7dd789da75bfb7792b84a28567552d234

General

Target
2026-07-23_1826f4714ce17c7be3fc1ae00daa9401_elex_floxif_wannacry
Size 48.4MB
Sample260723-bs29fstzaz
SHA256 f40e14257c6f48cdc827d8a63c2b9ad7dd789da75bfb7792b84a28567552d234
MD5 1826f4714ce17c7be3fc1ae00daa9401
SHA1 4c3fd200656aafc11996edaf9ed3345f247ef224
SHA512 53cb951718c0aea53e98d086629cba54b83ef8504ecb305dff76f588ca31c8537294c611361fd9f25fbd2153fe99f4e74e90d9c2716ba4d30a6508e5d542eb89
SSDEEP 1572864:eB2mdj/MJ4XiGFKkumhO77oRsVJ5odKWLf:eEmVMyXzFKkum0l5Wt
TLSH
T18AB7334107D0CAA7E67C06F0EF469581DCE65E3F56C3C24AAB847E5B0069382B6F771A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-23_1826f4714ce17c7be3fc1ae00daa9401_elex_floxif_wannacry
- Size 48.4MB
- SHA256 f40e14257c6f48cdc827d8a63c2b9ad7dd789da75bfb7792b84a28567552d234
- MD5 1826f4714ce17c7be3fc1ae00daa9401
- SHA1 4c3fd200656aafc11996edaf9ed3345f247ef224
- SHA512 53cb951718c0aea53e98d086629cba54b83ef8504ecb305dff76f588ca31c8537294c611361fd9f25fbd2153fe99f4e74e90d9c2716ba4d30a6508e5d542eb89
- SSDEEP 1572864:eB2mdj/MJ4XiGFKkumhO77oRsVJ5odKWLf:eEmVMyXzFKkum0l5Wt
- TLSH
  T18AB7334107D0CAA7E67C06F0EF469581DCE65E3F56C3C24AAB847E5B0069382B6F771A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor discovery floxif trojan upx persistence privilege_escalation
- Family: Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Detects Floxif payload
  backdoor
- UPX dump on OEP (original entry point)
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2