floxif | bc385e07abb3445ae102c6dd4359d2263a47d2c7abf75c2d49c7f836e2d288cc

General

Target
2026-08-09_2eb630dec1107ae2daac947e26ca6d22_amadey_elex_floxif_redline-stealer_rhadamanthys_smoke-loader_stop
Size 178KB
Sample260809-k77l6acm8x
SHA256 bc385e07abb3445ae102c6dd4359d2263a47d2c7abf75c2d49c7f836e2d288cc
MD5 2eb630dec1107ae2daac947e26ca6d22
SHA1 bdc26c6a8061a4998e1cadc021fb90366bb88248
SHA512 03b4fff3e63332edf97816596c248add911a47629b3b8b3f629e63c1712d379333b761630c6fb44687f8030481292545cc8f9a80a532cc263f62d8b0ad2713c6
SSDEEP 3072:AwR8J6hPchEyQIrZhbSJKbsQvVqRlkM4OAD/KLznBuB2JA2BjMGNp:AwR8J6pciY5bsQvMRlkM4RD/qzMfU1f
TLSH
T13304BE123B11D3FDD4100830305EA7452AE9FD3D066FA593F7423E5A2E3E396AB6961B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-09_2eb630dec1107ae2daac947e26ca6d22_amadey_elex_floxif_redline-stealer_rhadamanthys_smoke-loader_stop
- Size 178KB
- SHA256 bc385e07abb3445ae102c6dd4359d2263a47d2c7abf75c2d49c7f836e2d288cc
- MD5 2eb630dec1107ae2daac947e26ca6d22
- SHA1 bdc26c6a8061a4998e1cadc021fb90366bb88248
- SHA512 03b4fff3e63332edf97816596c248add911a47629b3b8b3f629e63c1712d379333b761630c6fb44687f8030481292545cc8f9a80a532cc263f62d8b0ad2713c6
- SSDEEP 3072:AwR8J6hPchEyQIrZhbSJKbsQvVqRlkM4OAD/KLznBuB2JA2BjMGNp:AwR8J6pciY5bsQvMRlkM4RD/qzMfU1f
- TLSH
  T13304BE123B11D3FDD4100830305EA7452AE9FD3D066FA593F7423E5A2E3E396AB6961B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor defense_evasion discovery floxif trojan upx persistence privilege_escalation
- Family: Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Modifies visibility of file extensions in Explorer
  defense_evasion
- Modifies visibility of hidden/system files in Explorer
  defense_evasion
- Detects Floxif payload
  backdoor
- UPX dump on OEP (original entry point)
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Network Service Discovery
  Attempt to gather information on host's network.
  discovery
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2