floxif | 8c8e7823d422b3d9455ecebb0b82f9290cec8f2647ffe706fa616a4f0a88ae7b

General

Target
2026-08-08_3716e5d979efc5c10771722d108a0bde_elex_floxif_wannacry
Size 13.5MB
Sample260808-ec33lasxfw
SHA256 8c8e7823d422b3d9455ecebb0b82f9290cec8f2647ffe706fa616a4f0a88ae7b
MD5 3716e5d979efc5c10771722d108a0bde
SHA1 83d65b0707ff7fdf84f658a50110bf6e430cfc32
SHA512 ccef2d8ded7f973eb54457947111b721307e3025fb48434ffcdfcc44f4c86b76410301f467d1ee3023aec4df22dfd98b4d4c6e5a9b7b03188b73135e53388fe9
SSDEEP 393216:DkEo10KMOAVF38IP94OIB9Lzzxy3p4G9l0glbqM:y10K3Ab38IF4rVy3p4GcE1
TLSH
T133E6336276D093F3E49AE0B7356602D500F89F2E72261A433314B643C6BD5A3B52E1EF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-08_3716e5d979efc5c10771722d108a0bde_elex_floxif_wannacry
- Size 13.5MB
- SHA256 8c8e7823d422b3d9455ecebb0b82f9290cec8f2647ffe706fa616a4f0a88ae7b
- MD5 3716e5d979efc5c10771722d108a0bde
- SHA1 83d65b0707ff7fdf84f658a50110bf6e430cfc32
- SHA512 ccef2d8ded7f973eb54457947111b721307e3025fb48434ffcdfcc44f4c86b76410301f467d1ee3023aec4df22dfd98b4d4c6e5a9b7b03188b73135e53388fe9
- SSDEEP 393216:DkEo10KMOAVF38IP94OIB9Lzzxy3p4G9l0glbqM:y10K3Ab38IF4rVy3p4GcE1
- TLSH
  T133E6336276D093F3E49AE0B7356602D500F89F2E72261A433314B643C6BD5A3B52E1EF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

adware backdoor defense_evasion discovery floxif spyware trojan upx persistence privilege_escalation
- Family: Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Detects Floxif payload
  backdoor
- UPX dump on OEP (original entry point)
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2