floxif | 7112e6f6e8a601ab228dabb0476b87b35d235f1311ea8cc6d0e88e75e14646db

General

Target
2026-07-24_68d8e6636c8d05f08809df0784513a83_elex_floxif_glassworm_hijackloader_remcos_stop
Size 3.1MB
Sample260724-wsdajstyhs
SHA256 7112e6f6e8a601ab228dabb0476b87b35d235f1311ea8cc6d0e88e75e14646db
MD5 68d8e6636c8d05f08809df0784513a83
SHA1 ef08dbdae5a887369c4dfa03a938f1e249fd6034
SHA512 934784cd5fddbe3e319ba9bf6227684359c7a601b21ab3d41f7fd111ef3e0e9be21818baf4189658475d8e6a52c3e95dfc18fcd16366ab13a47d457397fad8bb
SSDEEP 24576:xJwyrtWZANi3S8JYHYoDWLq8XsEbbjZtvFyEBQlQsSp/PlUhv+8+c+TC3OEJPrgB:TeFYHlCPbEEq+LTmOOyjEVq2uuza
TLSH
T1CDE5AF12F3E681A4E4F32AB0683F62259935BD199734C2CFA6503D0FAD317D1A934B97
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-24_68d8e6636c8d05f08809df0784513a83_elex_floxif_glassworm_hijackloader_remcos_stop
- Size 3.1MB
- SHA256 7112e6f6e8a601ab228dabb0476b87b35d235f1311ea8cc6d0e88e75e14646db
- MD5 68d8e6636c8d05f08809df0784513a83
- SHA1 ef08dbdae5a887369c4dfa03a938f1e249fd6034
- SHA512 934784cd5fddbe3e319ba9bf6227684359c7a601b21ab3d41f7fd111ef3e0e9be21818baf4189658475d8e6a52c3e95dfc18fcd16366ab13a47d457397fad8bb
- SSDEEP 24576:xJwyrtWZANi3S8JYHYoDWLq8XsEbbjZtvFyEBQlQsSp/PlUhv+8+c+TC3OEJPrgB:TeFYHlCPbEEq+LTmOOyjEVq2uuza
- TLSH
  T1CDE5AF12F3E681A4E4F32AB0683F62259935BD199734C2CFA6503D0FAD317D1A934B97
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor discovery floxif persistence privilege_escalation trojan upx
- Family: Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Detects Floxif payload
  backdoor
- UPX dump on OEP (original entry point)
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2