floxif | e326f5baa966bf5701f4d360b3562a6a7f3199d326ca0aa73ffc6474980bdb8c

General

Target
2026-07-28_5e205e970b91984957cea1c59f33c56b_elex_floxif_glassworm_maze
Size 2.1MB
Sample260728-thm1ws1tf1
SHA256 e326f5baa966bf5701f4d360b3562a6a7f3199d326ca0aa73ffc6474980bdb8c
MD5 5e205e970b91984957cea1c59f33c56b
SHA1 930ed4f64583d55f8f080c855f3721b36f1baea5
SHA512 62c28eee7c3dea509c58907c05e6c65c8bec6e58ad4f818db3d260ac3a8717eab681b3b572747db3b3dc389e4597bcdc1b90df00cc8fe2d0a3631c21107e1573
SSDEEP 49152:cVlvRIweozsEbQfXvBIsyBjuv11f1jKwsRAVnB7D:8hRDzsE0vJTCjut1qyVnF
TLSH
T12AA58C1677E840AAF1B252719EBC8763E676BC650B32D6CF5690420E1F32AD19E34733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-28_5e205e970b91984957cea1c59f33c56b_elex_floxif_glassworm_maze
- Size 2.1MB
- SHA256 e326f5baa966bf5701f4d360b3562a6a7f3199d326ca0aa73ffc6474980bdb8c
- MD5 5e205e970b91984957cea1c59f33c56b
- SHA1 930ed4f64583d55f8f080c855f3721b36f1baea5
- SHA512 62c28eee7c3dea509c58907c05e6c65c8bec6e58ad4f818db3d260ac3a8717eab681b3b572747db3b3dc389e4597bcdc1b90df00cc8fe2d0a3631c21107e1573
- SSDEEP 49152:cVlvRIweozsEbQfXvBIsyBjuv11f1jKwsRAVnB7D:8hRDzsE0vJTCjut1qyVnF
- TLSH
  T12AA58C1677E840AAF1B252719EBC8763E676BC650B32D6CF5690420E1F32AD19E34733
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor discovery floxif persistence trojan upx privilege_escalation
- Family: Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Detects Floxif payload
  backdoor
- UPX dump on OEP (original entry point)
- Drops file in Drivers directory
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2