floxif | 27844baeecc34fae3bd00cefd26e8cefb834f4b87a256ecac8df7cbf4403997c

General

Target
2026-08-09_55a48c026cb19b68be55d29eed9bec33_elex_floxif_glassworm_stop
Size 3.9MB
Sample260809-f7d8dshr5y
SHA256 27844baeecc34fae3bd00cefd26e8cefb834f4b87a256ecac8df7cbf4403997c
MD5 55a48c026cb19b68be55d29eed9bec33
SHA1 dddeb898b0482829d86319eae4b0361896b44f5c
SHA512 a1f50aeff3c550547800a970fe9653dd3a9919aa233cc1d889b365eda60f2bf1ba0cf96a26f2f8f36adcf9617cc38f17e007a2d3642df536920f2056b9e389fe
SSDEEP 49152:5yXCP7X3uQ3YlZfbM3DacNHHO0DZyL8x+2wmyrS5uDOzQfV7kfHWRHiaHSiBehGE:wcKNZf8mGHVD5x+2wTRN4fHgCF
TLSH
T1E916AF213FC1C43ED2630272D84DA35893F2D5B06E758557AAA9135D2F39EA3CE21E72
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-09_55a48c026cb19b68be55d29eed9bec33_elex_floxif_glassworm_stop
- Size 3.9MB
- SHA256 27844baeecc34fae3bd00cefd26e8cefb834f4b87a256ecac8df7cbf4403997c
- MD5 55a48c026cb19b68be55d29eed9bec33
- SHA1 dddeb898b0482829d86319eae4b0361896b44f5c
- SHA512 a1f50aeff3c550547800a970fe9653dd3a9919aa233cc1d889b365eda60f2bf1ba0cf96a26f2f8f36adcf9617cc38f17e007a2d3642df536920f2056b9e389fe
- SSDEEP 49152:5yXCP7X3uQ3YlZfbM3DacNHHO0DZyL8x+2wmyrS5uDOzQfV7kfHWRHiaHSiBehGE:wcKNZf8mGHVD5x+2wTRN4fHgCF
- TLSH
  T1E916AF213FC1C43ED2630272D84DA35893F2D5B06E758557AAA9135D2F39EA3CE21E72
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor bootkit discovery floxif persistence trojan upx
- Family: Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Detects Floxif payload
  backdoor
- UPX dump on OEP (original entry point)
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2