floxif | e0dac0fd3d516b89df1760de4857e7e614f1f0fdcd872296dcc6708c83a4b17f

General

Target
2026-08-09_1e76f1744ae5a47b932163576ea134d7_elex_floxif_remcos_rhadamanthys_smoke-loader_stealc_stop_tofsee
Size 1.0MB
Sample260809-ggs5asvxbt
SHA256 e0dac0fd3d516b89df1760de4857e7e614f1f0fdcd872296dcc6708c83a4b17f
MD5 1e76f1744ae5a47b932163576ea134d7
SHA1 168e2dbee6763ca426ddddbcc7797aa7d5ff8360
SHA512 a0ab496f47cb8f0a83673b521c04489d3123bb35e32e4c9fae74a35679d7d783ef1b8c58647d9417efa7649df2d26b1b438ace82db378f7fd0773e26d5f38040
SSDEEP 6144:ZaeuTkWVLKMwVtdDd9SaD7xj8VAO8R2JLBV+UdvrEFp7hKw:QTTfVWMwVv59jvxj8VQ0BjvrEH7v
TLSH
T145256C0CA781C2AFC761C470D8ABD1D96D956C344AC81D9F62BC7A1A39343ABC52F35E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-09_1e76f1744ae5a47b932163576ea134d7_elex_floxif_remcos_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.0MB
- SHA256 e0dac0fd3d516b89df1760de4857e7e614f1f0fdcd872296dcc6708c83a4b17f
- MD5 1e76f1744ae5a47b932163576ea134d7
- SHA1 168e2dbee6763ca426ddddbcc7797aa7d5ff8360
- SHA512 a0ab496f47cb8f0a83673b521c04489d3123bb35e32e4c9fae74a35679d7d783ef1b8c58647d9417efa7649df2d26b1b438ace82db378f7fd0773e26d5f38040
- SSDEEP 6144:ZaeuTkWVLKMwVtdDd9SaD7xj8VAO8R2JLBV+UdvrEFp7hKw:QTTfVWMwVv59jvxj8VQ0BjvrEH7v
- TLSH
  T145256C0CA781C2AFC761C470D8ABD1D96D956C344AC81D9F62BC7A1A39343ABC52F35E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor discovery floxif trojan upx persistence privilege_escalation
- Family: Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Detects Floxif payload
  backdoor
- UPX dump on OEP (original entry point)
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2