floxif | 06299656f3cb0844044873e4c07ba277c30cfd7d39f210b82a7fda98f9c1dce3

General

Target
2026-08-08_ac8afaf0dd669cf7ae66bc2ea4622680_coinminer_driverpack_elex_floxif_wannacry
Size 499KB
Sample260808-vzt17s1fpc
SHA256 06299656f3cb0844044873e4c07ba277c30cfd7d39f210b82a7fda98f9c1dce3
MD5 ac8afaf0dd669cf7ae66bc2ea4622680
SHA1 2f356a9508cc6d255f9b916dd2b66645772f6fb4
SHA512 1c1320b5b953e797c032ac8be43da5968d18e3fc3945512fca0855cec0eaf76e1965b01f12ba47919cecf910a05eb59fc2b27b6477b31d7bfd126d1e7f64c77d
SSDEEP 12288:M5393whFtnDsCkmAx9OzxBWYjqcm+mPIxP5whFBjvrEH7c:M53uhF5sCkmAx9M4AmANYrEH7c
TLSH
T180B401207AD643FEC1D739303908375969F6E23C0B2A05D7D751090A6EAE6D3CABD64B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-08_ac8afaf0dd669cf7ae66bc2ea4622680_coinminer_driverpack_elex_floxif_wannacry
- Size 499KB
- SHA256 06299656f3cb0844044873e4c07ba277c30cfd7d39f210b82a7fda98f9c1dce3
- MD5 ac8afaf0dd669cf7ae66bc2ea4622680
- SHA1 2f356a9508cc6d255f9b916dd2b66645772f6fb4
- SHA512 1c1320b5b953e797c032ac8be43da5968d18e3fc3945512fca0855cec0eaf76e1965b01f12ba47919cecf910a05eb59fc2b27b6477b31d7bfd126d1e7f64c77d
- SSDEEP 12288:M5393whFtnDsCkmAx9OzxBWYjqcm+mPIxP5whFBjvrEH7c:M53uhF5sCkmAx9M4AmANYrEH7c
- TLSH
  T180B401207AD643FEC1D739303908375969F6E23C0B2A05D7D751090A6EAE6D3CABD64B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

adware backdoor defense_evasion discovery execution floxif persistence privilege_escalation spyware trojan upx
- Family: Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Detects Floxif payload
  backdoor
- UPX dump on OEP (original entry point)
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
  defense_evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2