floxif | 1cb5cf1341e3c643392769bebd40931def01db45432da4ce1bc29a7dfcbd3e01

General

Target
2026-08-09_989d65f228a7c6b17dc617d47d46b3e2_agent-tesla_darkgate_elex_floxif_hawkeye_maze_remcos_xloader
Size 1.2MB
Sample260809-fvapfa1cmc
SHA256 1cb5cf1341e3c643392769bebd40931def01db45432da4ce1bc29a7dfcbd3e01
MD5 989d65f228a7c6b17dc617d47d46b3e2
SHA1 733e38800d581bd28036483332d1d1e1f6382a83
SHA512 1ae84ef99c1c7994266a2b3f612db3b3f698c5886e7463ec7f05218ff7c2fae99e5cbf923b79cc3ca7369fe2979d7621855fbfb6a65ba80895e25a9aae696614
SSDEEP 24576:Du6J3Ss0c+JY5UZ+XC0kGso6Fazr5uhwSUBD1quQKWYVrEH7xE:N50c++OCvkGs9Fazr5uqxpiYyE
TLSH
T19445CF2273DDC3A1CB669133BF69B3016EBB78794630B85B2F840D7DA9501B1166CB63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-09_989d65f228a7c6b17dc617d47d46b3e2_agent-tesla_darkgate_elex_floxif_hawkeye_maze_remcos_xloader
- Size 1.2MB
- SHA256 1cb5cf1341e3c643392769bebd40931def01db45432da4ce1bc29a7dfcbd3e01
- MD5 989d65f228a7c6b17dc617d47d46b3e2
- SHA1 733e38800d581bd28036483332d1d1e1f6382a83
- SHA512 1ae84ef99c1c7994266a2b3f612db3b3f698c5886e7463ec7f05218ff7c2fae99e5cbf923b79cc3ca7369fe2979d7621855fbfb6a65ba80895e25a9aae696614
- SSDEEP 24576:Du6J3Ss0c+JY5UZ+XC0kGso6Fazr5uhwSUBD1quQKWYVrEH7xE:N50c++OCvkGs9Fazr5uqxpiYyE
- TLSH
  T19445CF2273DDC3A1CB669133BF69B3016EBB78794630B85B2F840D7DA9501B1166CB63
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor discovery floxif trojan upx persistence privilege_escalation
- Family: Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Detects Floxif payload
  backdoor
- UPX dump on OEP (original entry point)
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2