floxif | 0dec76518e9b4b6880dd5731574ea42bbd5140e631c3e2915301d6773ea9c7f4

General

Target
2026-08-08_ddd24d4f1e41435add53905be35e0612_coinminer_driverpack_elex_floxif_wannacry
Size 2.2MB
Sample260808-sw3stshl8v
SHA256 0dec76518e9b4b6880dd5731574ea42bbd5140e631c3e2915301d6773ea9c7f4
MD5 ddd24d4f1e41435add53905be35e0612
SHA1 016b88fb6646a8e38738226a0f84209bbb4b3bda
SHA512 2109b149391065b36bee56f3dec0744916ed1c437ac274ab46b6ba6b8670c85db18492bdcf9a0ac5b858566344ee78eef1718ffc1c04d8f8c6dade82a2dbb9a1
SSDEEP 49152:b5dhF9Q2lG2o9h5YVcqfatSyv++3Qp+NwxAYlrMyRsJfIzS:b5jF9QH2AsxCtSyWBGYx3RWAe
TLSH
T13DB52311339583FACE522172750873BEA6E9E73F8F1E46DB835015426E1E5D2863CECA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-08_ddd24d4f1e41435add53905be35e0612_coinminer_driverpack_elex_floxif_wannacry
- Size 2.2MB
- SHA256 0dec76518e9b4b6880dd5731574ea42bbd5140e631c3e2915301d6773ea9c7f4
- MD5 ddd24d4f1e41435add53905be35e0612
- SHA1 016b88fb6646a8e38738226a0f84209bbb4b3bda
- SHA512 2109b149391065b36bee56f3dec0744916ed1c437ac274ab46b6ba6b8670c85db18492bdcf9a0ac5b858566344ee78eef1718ffc1c04d8f8c6dade82a2dbb9a1
- SSDEEP 49152:b5dhF9Q2lG2o9h5YVcqfatSyv++3Qp+NwxAYlrMyRsJfIzS:b5jF9QH2AsxCtSyWBGYx3RWAe
- TLSH
  T13DB52311339583FACE522172750873BEA6E9E73F8F1E46DB835015426E1E5D2863CECA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor discovery floxif trojan upx persistence privilege_escalation
- Family: Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Detects Floxif payload
  backdoor
- UPX dump on OEP (original entry point)
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2