floxif | 4c5b6a8bd1f84897e3c5dde1098700801863a6b09cf03c18384da3aa8ec3fca4

General

Target
2026-07-28_92dc84e6357c0008547d87a2cc490a56_amadey_elex_emotet_floxif_smoke-loader_stop
Size 388KB
Sample260728-y4lr6svene
SHA256 4c5b6a8bd1f84897e3c5dde1098700801863a6b09cf03c18384da3aa8ec3fca4
MD5 92dc84e6357c0008547d87a2cc490a56
SHA1 cea832eb13df9be2535a5c0f768b5d67fd5f9384
SHA512 a6cf94ec4c477a68b8828f79464b6b789345143ab0ec6ea259d3ef595937b0020acd93dd15c71b34e6c0274bb9fd5d598a42d5e62106f6a773d0b46bc833db2c
SSDEEP 6144:XyOAUDUZpkcKi3wzwtDVnaJDTpibC8CYrZQjUrR3mgaEP2OFBx60BV+UdvrEFp7k:XRrct3QJD1i+8CwSOuj0BjvrEH7YB
TLSH
T18984AE0177E0CBB9C1A315326E629B54A3F6FD395F3686476398370DED38A41CB2532A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-28_92dc84e6357c0008547d87a2cc490a56_amadey_elex_emotet_floxif_smoke-loader_stop
- Size 388KB
- SHA256 4c5b6a8bd1f84897e3c5dde1098700801863a6b09cf03c18384da3aa8ec3fca4
- MD5 92dc84e6357c0008547d87a2cc490a56
- SHA1 cea832eb13df9be2535a5c0f768b5d67fd5f9384
- SHA512 a6cf94ec4c477a68b8828f79464b6b789345143ab0ec6ea259d3ef595937b0020acd93dd15c71b34e6c0274bb9fd5d598a42d5e62106f6a773d0b46bc833db2c
- SSDEEP 6144:XyOAUDUZpkcKi3wzwtDVnaJDTpibC8CYrZQjUrR3mgaEP2OFBx60BV+UdvrEFp7k:XRrct3QJD1i+8CwSOuj0BjvrEH7YB
- TLSH
  T18984AE0177E0CBB9C1A315326E629B54A3F6FD395F3686476398370DED38A41CB2532A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor discovery floxif trojan upx persistence privilege_escalation
- Family: Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Detects Floxif payload
  backdoor
- UPX dump on OEP (original entry point)
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2