floxif | ccae0354c04b8e681e0ab50633588c58b34726c24a6983833032100e428457dc

General

Target
2026-08-09_293d64b611ab2946808f24e344924306_amadey_elex_floxif_glassworm_remcos_smoke-loader_stop
Size 2.7MB
Sample260809-gewseavwhw
SHA256 ccae0354c04b8e681e0ab50633588c58b34726c24a6983833032100e428457dc
MD5 293d64b611ab2946808f24e344924306
SHA1 6e6b699f24c259ae1f6e1ae5e9cfbcb742433eff
SHA512 0849dc067fe0106a714d6e74d0bc60364f06cf69bb97f6be655f1d7112ebaff02bea0792cdf784949f504509e628a8da85b2bda3c6151672c1d0335c5283ef13
SSDEEP 49152:bupeQ9Xpajz7BRCVBAAzcE/9puRnjqt5ig4Uc4zelgqGkXgcB/T:byeQ9XA9geE/9ARnjg5ig4UXkMkXz
TLSH
T101D53A36B741E53BC66314335D5E57EF1298B7B018B2541BEB4C0A2C27B5AE28B32763
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-09_293d64b611ab2946808f24e344924306_amadey_elex_floxif_glassworm_remcos_smoke-loader_stop
- Size 2.7MB
- SHA256 ccae0354c04b8e681e0ab50633588c58b34726c24a6983833032100e428457dc
- MD5 293d64b611ab2946808f24e344924306
- SHA1 6e6b699f24c259ae1f6e1ae5e9cfbcb742433eff
- SHA512 0849dc067fe0106a714d6e74d0bc60364f06cf69bb97f6be655f1d7112ebaff02bea0792cdf784949f504509e628a8da85b2bda3c6151672c1d0335c5283ef13
- SSDEEP 49152:bupeQ9Xpajz7BRCVBAAzcE/9puRnjqt5ig4Uc4zelgqGkXgcB/T:byeQ9XA9geE/9ARnjg5ig4UXkMkXz
- TLSH
  T101D53A36B741E53BC66314335D5E57EF1298B7B018B2541BEB4C0A2C27B5AE28B32763
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor bootkit discovery floxif persistence trojan upx privilege_escalation
- Family: Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Detects Floxif payload
  backdoor
- UPX dump on OEP (original entry point)
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2