floxif | 52c28110347e862b74a7c178e0d4f79da0e014d8c292fc55e4430002f9e37d46

General

Target
2026-07-28_1834d7a331b1bbe914e0fb512c7b1167_amadey_elex_floxif_rhadamanthys_smoke-loader_stop
Size 534KB
Sample260728-gnkrhazxbs
SHA256 52c28110347e862b74a7c178e0d4f79da0e014d8c292fc55e4430002f9e37d46
MD5 1834d7a331b1bbe914e0fb512c7b1167
SHA1 2e8df783b37a82a43d8ee4a4605147f5c8828f75
SHA512 23c38dc2bb0d2adf22df490e03e83bdcd1356637983f1c9c86f3646e871d374bf88e7a7becf7bcad102065f50f2c5c571ec2671ee837392543a26f0ac746a67b
SSDEEP 12288:mvqSyJda/julZAuYL9+01/gWxiEGwZBjvrEH7p2:6UJdaebYVoGiiHrEH7p2
TLSH
T138C4BF113790CBF7C25230332499E77522EAB9395B6683C777501B6E9E386E3993831B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-28_1834d7a331b1bbe914e0fb512c7b1167_amadey_elex_floxif_rhadamanthys_smoke-loader_stop
- Size 534KB
- SHA256 52c28110347e862b74a7c178e0d4f79da0e014d8c292fc55e4430002f9e37d46
- MD5 1834d7a331b1bbe914e0fb512c7b1167
- SHA1 2e8df783b37a82a43d8ee4a4605147f5c8828f75
- SHA512 23c38dc2bb0d2adf22df490e03e83bdcd1356637983f1c9c86f3646e871d374bf88e7a7becf7bcad102065f50f2c5c571ec2671ee837392543a26f0ac746a67b
- SSDEEP 12288:mvqSyJda/julZAuYL9+01/gWxiEGwZBjvrEH7p2:6UJdaebYVoGiiHrEH7p2
- TLSH
  T138C4BF113790CBF7C25230332499E77522EAB9395B6683C777501B6E9E386E3993831B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor discovery floxif persistence privilege_escalation trojan upx
- Family: Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Detects Floxif payload
  backdoor
- UPX dump on OEP (original entry point)
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2