floxif | d71c4ea49b0134b14b8391ccd12212c9145dbef43043517c33c261208fa0bf16

General

Target
2026-08-09_ecde50729aba852b8eef992c8f84ab7a_amadey_darkgate_elex_floxif_glassworm_magniber_smoke-loader
Size 5.9MB
Sample260809-fdx4ea1ajd
SHA256 d71c4ea49b0134b14b8391ccd12212c9145dbef43043517c33c261208fa0bf16
MD5 ecde50729aba852b8eef992c8f84ab7a
SHA1 8cf62333aba4aa0287c612fc100991e4bd9f171f
SHA512 bb2e458d87b254da5d39cd44b02d1d030a34f33c619fd595592266c386cac0394632e6f7ed45a0a3922297f2f92eba4027f37b19654ac59e5f32ce45a1753c84
SSDEEP 98304:bE3VAQi35kYa4NWMFzxr91Peclim/HhCoIjb3IdAQT4WUWAhPAQIarW+Y5s:bE3+5kYfik6JQT9EhAlargs
TLSH
T14556AD20AF9DC52FF1A614B0593D061A49687E31376494CBB3C43D9ED672BD2AA30F1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-09_ecde50729aba852b8eef992c8f84ab7a_amadey_darkgate_elex_floxif_glassworm_magniber_smoke-loader
- Size 5.9MB
- SHA256 d71c4ea49b0134b14b8391ccd12212c9145dbef43043517c33c261208fa0bf16
- MD5 ecde50729aba852b8eef992c8f84ab7a
- SHA1 8cf62333aba4aa0287c612fc100991e4bd9f171f
- SHA512 bb2e458d87b254da5d39cd44b02d1d030a34f33c619fd595592266c386cac0394632e6f7ed45a0a3922297f2f92eba4027f37b19654ac59e5f32ce45a1753c84
- SSDEEP 98304:bE3VAQi35kYa4NWMFzxr91Peclim/HhCoIjb3IdAQT4WUWAhPAQIarW+Y5s:bE3+5kYfik6JQT9EhAlargs
- TLSH
  T14556AD20AF9DC52FF1A614B0593D061A49687E31376494CBB3C43D9ED672BD2AA30F1B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor defense_evasion discovery floxif trojan upx persistence privilege_escalation
- Family: Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Detects Floxif payload
  backdoor
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- UPX dump on OEP (original entry point)
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2