floxif | 84c8abf43f98372bcf23d2e4f7c0be2a27b3bf746901597b30e6a8b54d86b882

General

Target
2026-08-08_f7291348473dcc008e67142b217c3c5e_amadey_coinminer_cryptbot_darkgate_elex_floxif_glassworm_remcos_rhadamanthys_smoke-loader_wannacry
Size 22.9MB
Sample260808-srzklseb43
SHA256 84c8abf43f98372bcf23d2e4f7c0be2a27b3bf746901597b30e6a8b54d86b882
MD5 f7291348473dcc008e67142b217c3c5e
SHA1 837cbe65087e5475231cf2e6f259fc82e116be2e
SHA512 8073dde4d5978f582aab7dc766353b88974b39a4794985e1fb2154ecdba7bc7ec54ad5ff643b719a9374752e10405eee52bc9543d8b945f17b22e1bbac9cdf34
SSDEEP 393216:DGuhD/4VIfoCkhfO/zFXGW/F/P9wXiXzThbcey08epzP:DGupsaRkdObGXYztbceyAzP
TLSH
T12637CF11FBC240B1F5A3527085AAD33B8A377A114632CDDFF78C6949BB33691593A329
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-08_f7291348473dcc008e67142b217c3c5e_amadey_coinminer_cryptbot_darkgate_elex_floxif_glassworm_remcos_rhadamanthys_smoke-loader_wannacry
- Size 22.9MB
- SHA256 84c8abf43f98372bcf23d2e4f7c0be2a27b3bf746901597b30e6a8b54d86b882
- MD5 f7291348473dcc008e67142b217c3c5e
- SHA1 837cbe65087e5475231cf2e6f259fc82e116be2e
- SHA512 8073dde4d5978f582aab7dc766353b88974b39a4794985e1fb2154ecdba7bc7ec54ad5ff643b719a9374752e10405eee52bc9543d8b945f17b22e1bbac9cdf34
- SSDEEP 393216:DGuhD/4VIfoCkhfO/zFXGW/F/P9wXiXzThbcey08epzP:DGupsaRkdObGXYztbceyAzP
- TLSH
  T12637CF11FBC240B1F5A3527085AAD33B8A377A114632CDDFF78C6949BB33691593A329
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor credential_access defense_evasion discovery execution floxif persistence privilege_escalation trojan upx
- Family: Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Detected Nirsoft tools
  Free utilities often used by attackers which can steal passwords, product keys, etc.
- Detects Floxif payload
  backdoor
- OS Credential Dumping: Security Account Manager
  Malicious Registry Hive Dumping.
  credential_access
- UPX dump on OEP (original entry point)
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- Modifies Windows Firewall
  defense_evasion
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates new service(s)
  persistence execution
- Executes dropped EXE
- Loads dropped DLL
- Stops running service(s)
  defense_evasion execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- Executes a VBScript file via the Windows Script Host.
  execution
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2