floxif | b8ae4526b608b83571ec35484da90ea23526785ca3de29155eb1b17663a540af

General

Target
2026-08-09_f9da78bbd4770e63969e42c246d52c70_coinminer_elex_floxif_helldown_luca-stealer_mespinoza_njrat_remcos
Size 5.3MB
Sample260809-fbfrcazhmf
SHA256 b8ae4526b608b83571ec35484da90ea23526785ca3de29155eb1b17663a540af
MD5 f9da78bbd4770e63969e42c246d52c70
SHA1 46ae0196a887d622b7d80660d2688081c4981c0c
SHA512 ec6a29736cbfd9d88a80a4ce4a67aa1da52d0dcf0cf92e95b135742ca65f7d29731f67ee6cb30953f24a982be586714ca3f2764049df28976cfe4f604a44743e
SSDEEP 98304:jRNVQM+ljUIH8+4H0GM1up6++bsqNiP/ichQy:lp+CId4UfY71
TLSH
T12C46C01179D58436D33317325D2EA62F92FABDB04F31C58F63A82B2E2B719825625733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-09_f9da78bbd4770e63969e42c246d52c70_coinminer_elex_floxif_helldown_luca-stealer_mespinoza_njrat_remcos
- Size 5.3MB
- SHA256 b8ae4526b608b83571ec35484da90ea23526785ca3de29155eb1b17663a540af
- MD5 f9da78bbd4770e63969e42c246d52c70
- SHA1 46ae0196a887d622b7d80660d2688081c4981c0c
- SHA512 ec6a29736cbfd9d88a80a4ce4a67aa1da52d0dcf0cf92e95b135742ca65f7d29731f67ee6cb30953f24a982be586714ca3f2764049df28976cfe4f604a44743e
- SSDEEP 98304:jRNVQM+ljUIH8+4H0GM1up6++bsqNiP/ichQy:lp+CId4UfY71
- TLSH
  T12C46C01179D58436D33317325D2EA62F92FABDB04F31C58F63A82B2E2B719825625733
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor discovery floxif persistence spyware stealer trojan upx privilege_escalation
- Family: Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Detects Floxif payload
  backdoor
- UPX dump on OEP (original entry point)
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Loads dropped DLL
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks for any installed AV software in registry
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2