floxif | d0e67109f8091df4a76cf5cf44164c2470ad415cb21a3f054290e040fb13b27f

General

Target
2026-08-08_1daa9cc2cf41cb52c747c832ccd5e5f8_amadey_darkgate_elex_floxif_glassworm_magniber_smoke-loader
Size 5.9MB
Sample260808-txkt3saj5w
SHA256 d0e67109f8091df4a76cf5cf44164c2470ad415cb21a3f054290e040fb13b27f
MD5 1daa9cc2cf41cb52c747c832ccd5e5f8
SHA1 6300cac034b40178c33d668723dc862bcd4bbba0
SHA512 470b6b7edfb66881db70840e2af7d7dba281bb4adce97497caa5819e4e1c9be70dd638e9692fc2555162d3b7f7ec304b3728bced9ff7c968655fc54f3a61c433
SSDEEP 98304:uE3XAQi35kYa4NWMFzxr91Peclim/HhCoIjb3IdAQT4WUWAhPAQIarW+Y5c:uE3Q5kYfik6JQT9EhAlargc
TLSH
T10C56AD20AF9DC52FF1A614B0593D061A49687E31376494CBB3C43D9ED672BD2AA30F1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-08_1daa9cc2cf41cb52c747c832ccd5e5f8_amadey_darkgate_elex_floxif_glassworm_magniber_smoke-loader
- Size 5.9MB
- SHA256 d0e67109f8091df4a76cf5cf44164c2470ad415cb21a3f054290e040fb13b27f
- MD5 1daa9cc2cf41cb52c747c832ccd5e5f8
- SHA1 6300cac034b40178c33d668723dc862bcd4bbba0
- SHA512 470b6b7edfb66881db70840e2af7d7dba281bb4adce97497caa5819e4e1c9be70dd638e9692fc2555162d3b7f7ec304b3728bced9ff7c968655fc54f3a61c433
- SSDEEP 98304:uE3XAQi35kYa4NWMFzxr91Peclim/HhCoIjb3IdAQT4WUWAhPAQIarW+Y5c:uE3Q5kYfik6JQT9EhAlargc
- TLSH
  T10C56AD20AF9DC52FF1A614B0593D061A49687E31376494CBB3C43D9ED672BD2AA30F1B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor defense_evasion discovery floxif persistence privilege_escalation trojan upx
- Family: Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Detects Floxif payload
  backdoor
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- UPX dump on OEP (original entry point)
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2