floxif | 6233f93710b614697a08ada2ee320c673daa968d800aa86da9d80324d59dd2f2

General

Target
2026-08-08_39c02ab06dc492b4414a2824384989bd_agent-tesla_backswap_elex_floxif_remcos_stop
Size 799KB
Sample260808-tsatbavsaw
SHA256 6233f93710b614697a08ada2ee320c673daa968d800aa86da9d80324d59dd2f2
MD5 39c02ab06dc492b4414a2824384989bd
SHA1 0481c6b2a3faf2fc05a9c983c0bcf94c1c936e86
SHA512 878d8a092b8e8e7b99f05ffa1edee741c3253021e447e8b258ab8a2c5f2a81b0d048127b272409a3bc959c63d02b3e9ac7c34a3242ddb3aa7bfa13f907db6379
SSDEEP 12288:AaWzgMF7v3qnCiAErQohh0F4EqCJ8lnylQ2X28mn45iyRbfBjvrEH758:naHFv6CUrjJnylQ2X28mn4UeJrEH7G
TLSH
T18505C012B7D681F6D9933871397BE32BDB35652D0327C48BA7E12E728F211015B3A762
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-08_39c02ab06dc492b4414a2824384989bd_agent-tesla_backswap_elex_floxif_remcos_stop
- Size 799KB
- SHA256 6233f93710b614697a08ada2ee320c673daa968d800aa86da9d80324d59dd2f2
- MD5 39c02ab06dc492b4414a2824384989bd
- SHA1 0481c6b2a3faf2fc05a9c983c0bcf94c1c936e86
- SHA512 878d8a092b8e8e7b99f05ffa1edee741c3253021e447e8b258ab8a2c5f2a81b0d048127b272409a3bc959c63d02b3e9ac7c34a3242ddb3aa7bfa13f907db6379
- SSDEEP 12288:AaWzgMF7v3qnCiAErQohh0F4EqCJ8lnylQ2X28mn45iyRbfBjvrEH758:naHFv6CUrjJnylQ2X28mn4UeJrEH7G
- TLSH
  T18505C012B7D681F6D9933871397BE32BDB35652D0327C48BA7E12E728F211015B3A762
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor discovery floxif persistence privilege_escalation trojan upx
- Family: Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Detects Floxif payload
  backdoor
- Custom signature
  
  UPX dump on OEP (original entry point)
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2