General
- Target 2026-08-09_6f30f3d987fe4b6ac14fade38ed41dc5_coinminer_elex_floxif_wannacry
- Size 731KB
- Sample260809-f2rlja1elc
- SHA256 675e7f8741c822841b29af732170a905206cf4f89b345990fc3e01a2c1d4cb3f
Malware Config
Targets
-
- Target 2026-08-09_6f30f3d987fe4b6ac14fade38ed41dc5_coinminer_elex_floxif_wannacry
- Size 731KB
- SHA256 675e7f8741c822841b29af732170a905206cf4f89b345990fc3e01a2c1d4cb3f
Score10/10-
Family: Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
-
Detects Floxif payload
-
UPX dump on OEP (original entry point)
-
Drops file in Drivers directory
-
Manipulates Digital Signatures
Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
-
Modifies Windows Firewall
-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
-
Executes a VBScript file via the Windows Script Host.
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2Visual Basic
1Windows Command Shell
1Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
1Subvert Trust Controls
2Install Root Certificate
1SIP and Trust Provider Hijacking
1