floxif | 269fabb386751d1eb9bc597c748e54d71a132dd316e0b41dac12457a2b10a4be

General

Target
2026-08-09_7633a84c767a9f72f4db030b622b331b_elex_floxif_redline-stealer_rhadamanthys_stop_swisyn
Size 2.7MB
Sample260809-c9qsesgm91
SHA256 269fabb386751d1eb9bc597c748e54d71a132dd316e0b41dac12457a2b10a4be
MD5 7633a84c767a9f72f4db030b622b331b
SHA1 0cf07f58483d728e4f65605663d5f82b6d3db6d3
SHA512 714600600d9e0bacdb7012a56c8fbc8b08721e5385a8377d4bb9718a390a7f14b1b080922aec7e7008c54cddfec14d381c8a62939ac6d88e3855073297c77581
SSDEEP 49152:5lmTRR0i90cyIw/wj3ka4NSV9dvLWqbURdk/qy3pvY2dPLUBIIOpyZP1Qpf:bo0i90TIc4UJSpvLWdQZ3pvtdPw2IOpt
TLSH
T124D523233B8092BAD42585B068A5D53A7960BD3F0BA09DCFF355B71C5A7928379B430B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-09_7633a84c767a9f72f4db030b622b331b_elex_floxif_redline-stealer_rhadamanthys_stop_swisyn
- Size 2.7MB
- SHA256 269fabb386751d1eb9bc597c748e54d71a132dd316e0b41dac12457a2b10a4be
- MD5 7633a84c767a9f72f4db030b622b331b
- SHA1 0cf07f58483d728e4f65605663d5f82b6d3db6d3
- SHA512 714600600d9e0bacdb7012a56c8fbc8b08721e5385a8377d4bb9718a390a7f14b1b080922aec7e7008c54cddfec14d381c8a62939ac6d88e3855073297c77581
- SSDEEP 49152:5lmTRR0i90cyIw/wj3ka4NSV9dvLWqbURdk/qy3pvY2dPLUBIIOpyZP1Qpf:bo0i90TIc4UJSpvLWdQZ3pvtdPw2IOpt
- TLSH
  T124D523233B8092BAD42585B068A5D53A7960BD3F0BA09DCFF355B71C5A7928379B430B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor defense_evasion discovery floxif persistence privilege_escalation trojan upx
- Family: Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Modifies visibility of hidden/system files in Explorer
  defense_evasion
- Detects Floxif payload
  backdoor
- UPX dump on OEP (original entry point)
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2