Extracted

• • Target
    2026-08-05_98a147ce6e9d671a6f4a91fed0477fe2_elex_floxif_wannacry
  • Size 177KB
  • SHA256 7aa3df971efb57af1dfef424d1f6748b72af00010cb8f1bb04d090e26df0a078
  • MD5 98a147ce6e9d671a6f4a91fed0477fe2
  • SHA1 c14a19558388351df45d2c57cebf12de6a1f6523
  • SHA512 81828ef5823bdf111e75e7f4d26e388a282d89c3b0dfe2439a98cd670d65db0da54a021ef799dab07f9dbd6283769d83352acbd2eff50eeb57f7c41f631cd808
  • SSDEEP 3072:Vq7DiX2seVWllSP8QLZwgtTIFFjB/K2lQBV+UdE+rECWp7hKBK2:I7Di7eTlZw3FjeBV+UdvrEFp7hKI2
  • TLSH
    T153047C11F541C7FDF06400B6BABD6A7BA9E89D3C070A20C3E3D029965E6D9D27A7021F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoveryevasionfloxifphorphiexloaderpersistencetrojanupxworm

  • Family: Floxif, Floodfix

    Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.

    backdoortrojanfloxif

  • Family: Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • Phorphiex payload

  • Windows security bypass

    defense_evasiontrojan

  • Detects Floxif payload

    backdoor

  • UPX dump on OEP (original entry point)

  • ACProtect 1.3x - 1.4x DLL software

    Detects file using ACProtect software.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    defense_evasiontrojan

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2