floxif | 20856365eb7ef98695a9ca5a6ec9f25c34fbe25fff728ee67889fcee7165ebd9

General

Target
2026-08-09_c94fcd11ff9403302c62f09c81576785_amadey_elex_floxif_konni_smoke-loader_stealc_stop_tofsee
Size 679KB
Sample260809-flkhaatza1
SHA256 20856365eb7ef98695a9ca5a6ec9f25c34fbe25fff728ee67889fcee7165ebd9
MD5 c94fcd11ff9403302c62f09c81576785
SHA1 1031f9b98bd69c073bfaeac1d34beaca63557a05
SHA512 5eaa07f867dc99eac454e35171ebd9ff405ea428463d143207f4ac674c198daf5687586c974992d0cc681547ff805850e512b3b1dd0b1985562064e2a55a4a93
SSDEEP 12288:YRWNcVpoHntNw97oByJo4k1ao+RO0u3EH5z3uTkVSnyFgBjvrEH7Mg:7NO6tS97oByG1aX1CECY4rEH71
TLSH
T14EE4015275C0C3FAD0271430BABC9B70A9F9E83D5676808ABB910A1D6F7D9A3C705B47
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-09_c94fcd11ff9403302c62f09c81576785_amadey_elex_floxif_konni_smoke-loader_stealc_stop_tofsee
- Size 679KB
- SHA256 20856365eb7ef98695a9ca5a6ec9f25c34fbe25fff728ee67889fcee7165ebd9
- MD5 c94fcd11ff9403302c62f09c81576785
- SHA1 1031f9b98bd69c073bfaeac1d34beaca63557a05
- SHA512 5eaa07f867dc99eac454e35171ebd9ff405ea428463d143207f4ac674c198daf5687586c974992d0cc681547ff805850e512b3b1dd0b1985562064e2a55a4a93
- SSDEEP 12288:YRWNcVpoHntNw97oByJo4k1ao+RO0u3EH5z3uTkVSnyFgBjvrEH7Mg:7NO6tS97oByG1aX1CECY4rEH71
- TLSH
  T14EE4015275C0C3FAD0271430BABC9B70A9F9E83D5676808ABB910A1D6F7D9A3C705B47
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor bootkit defense_evasion discovery execution floxif persistence trojan upx
- Family: Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Detects Floxif payload
  backdoor
- UPX dump on OEP (original entry point)
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2