floxif | 1f02cd339d46905dd5912609b420fe60c4286cd8eff93bc3a1c1f6ea7877ea7c

General

Target
2026-07-23_d2aa6317097b20befd730fe302bfa17b_coinminer_dosia_elex_floxif_frostygoop_glassworm_hive_poet-rat_quasar-rat_salatstealer_sliver_snatch
Size 10.1MB
Sample260724-bfxs7sel9z
SHA256 1f02cd339d46905dd5912609b420fe60c4286cd8eff93bc3a1c1f6ea7877ea7c
MD5 d2aa6317097b20befd730fe302bfa17b
SHA1 eb845c0fbf758a6db38282bf0c7f89963243b5ce
SHA512 5732ee4f24449927fd505718ee1f0a1049c1668f2321312f929bc224317a5ede9bf97b89f53d817c3ef88598a02a7f2bb4152e48c31367e9740b8e5c03399f28
SSDEEP 98304:b+8WQ5fXBwJ+/Xhg+LPzK7k7bpi6KJOsGAverWEi9:bQQhBnvRPpXE6KJMAvYi9
TLSH
T139B63901FECB94F6E903157141ABA36F27306D098B24CBDBEB547B2AF9776D20876205
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-23_d2aa6317097b20befd730fe302bfa17b_coinminer_dosia_elex_floxif_frostygoop_glassworm_hive_poet-rat_quasar-rat_salatstealer_sliver_snatch
- Size 10.1MB
- SHA256 1f02cd339d46905dd5912609b420fe60c4286cd8eff93bc3a1c1f6ea7877ea7c
- MD5 d2aa6317097b20befd730fe302bfa17b
- SHA1 eb845c0fbf758a6db38282bf0c7f89963243b5ce
- SHA512 5732ee4f24449927fd505718ee1f0a1049c1668f2321312f929bc224317a5ede9bf97b89f53d817c3ef88598a02a7f2bb4152e48c31367e9740b8e5c03399f28
- SSDEEP 98304:b+8WQ5fXBwJ+/Xhg+LPzK7k7bpi6KJOsGAverWEi9:bQQhBnvRPpXE6KJMAvYi9
- TLSH
  T139B63901FECB94F6E903157141ABA36F27306D098B24CBDBEB547B2AF9776D20876205
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor discovery floxif persistence privilege_escalation trojan upx
- Family: Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Detects Floxif payload
  backdoor
- UPX dump on OEP (original entry point)
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2