floxif | 998b95522404aefda17d8b3939027d72b03fb276930e73e905b0c2dc1682e3b2

General

Target
2026-08-09_b54ff82ea2639ed64cc4cb72b51a41f4_amadey_elex_floxif_wannacry
Size 2.3MB
Sample260809-fphsvs1bpa
SHA256 998b95522404aefda17d8b3939027d72b03fb276930e73e905b0c2dc1682e3b2
MD5 b54ff82ea2639ed64cc4cb72b51a41f4
SHA1 2c7e618b378e46809238935310dace3ba1fbb5a2
SHA512 fbf636a8f0d2238cdee0ec7e5286f65e73a2c3548a8e573a51a9e67787fa9dc24c3046a0c6c314994830dca1563e9e83bf0b2c3be12ccc535f5acbfaecee66d3
SSDEEP 49152:Y8ecZHgJevFz9q4fcuBSccghdccyt4ZVO:Be2A4jByghPq2E
TLSH
T1BFB5BF017391837EF9D366B29CD46D3687B47F450B11488B32AC7F1ABB721B2AD78219
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-09_b54ff82ea2639ed64cc4cb72b51a41f4_amadey_elex_floxif_wannacry
- Size 2.3MB
- SHA256 998b95522404aefda17d8b3939027d72b03fb276930e73e905b0c2dc1682e3b2
- MD5 b54ff82ea2639ed64cc4cb72b51a41f4
- SHA1 2c7e618b378e46809238935310dace3ba1fbb5a2
- SHA512 fbf636a8f0d2238cdee0ec7e5286f65e73a2c3548a8e573a51a9e67787fa9dc24c3046a0c6c314994830dca1563e9e83bf0b2c3be12ccc535f5acbfaecee66d3
- SSDEEP 49152:Y8ecZHgJevFz9q4fcuBSccghdccyt4ZVO:Be2A4jByghPq2E
- TLSH
  T1BFB5BF017391837EF9D366B29CD46D3687B47F450B11488B32AC7F1ABB721B2AD78219
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor discovery execution floxif trojan upx persistence privilege_escalation
- Family: Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Detects Floxif payload
  backdoor
- UPX dump on OEP (original entry point)
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Executes a VBScript file via the Windows Script Host.
  execution
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2