floxif | f6defd6a594921dd010729dd891c43e14a2e45b2a7168b8cba3efa727b71c3f3

General

Target
2026-08-09_db43cffed243dbfaac6342321c155618_coinminer_elex_floxif_helldown_luca-stealer_mespinoza_njrat_remcos
Size 5.3MB
Sample260809-fhdkkagg36
SHA256 f6defd6a594921dd010729dd891c43e14a2e45b2a7168b8cba3efa727b71c3f3
MD5 db43cffed243dbfaac6342321c155618
SHA1 0a254f31641dc6fb22462772ded4fbefc4fd83a4
SHA512 c08e56dc23f892af35f233ebd2c3f663b3cbaf587137370f680e6b61bbf2369d5acf70fb97a0fdd30125261d36849db19e423b299659212730f3b5027532f92a
SSDEEP 98304:jRNVgM+ljUIm8+4H0GM1up6z+bsqNiP/ichQD:l5+CIW4UYY7I
TLSH
T1C346C01179D58436D33327325D2EA62F92FABDB04F31C58F63A82B2D2B719825625733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-09_db43cffed243dbfaac6342321c155618_coinminer_elex_floxif_helldown_luca-stealer_mespinoza_njrat_remcos
- Size 5.3MB
- SHA256 f6defd6a594921dd010729dd891c43e14a2e45b2a7168b8cba3efa727b71c3f3
- MD5 db43cffed243dbfaac6342321c155618
- SHA1 0a254f31641dc6fb22462772ded4fbefc4fd83a4
- SHA512 c08e56dc23f892af35f233ebd2c3f663b3cbaf587137370f680e6b61bbf2369d5acf70fb97a0fdd30125261d36849db19e423b299659212730f3b5027532f92a
- SSDEEP 98304:jRNVgM+ljUIm8+4H0GM1up6z+bsqNiP/ichQD:l5+CIW4UYY7I
- TLSH
  T1C346C01179D58436D33327325D2EA62F92FABDB04F31C58F63A82B2D2B719825625733
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor discovery floxif persistence privilege_escalation spyware stealer trojan upx
- Family: Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Detects Floxif payload
  backdoor
- UPX dump on OEP (original entry point)
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Loads dropped DLL
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks for any installed AV software in registry
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2