floxif | f78a5acdc8a56a09b6e77258c478ec025b33e10c2b9bc293e57c8fc5911c36e8

General

Target
2026-08-09_23b59cf8fe1d58bbb173da968b7918a2_amadey_elex_floxif_redline-stealer_rhadamanthys_smoke-loader_stop
Size 178KB
Sample260809-pv3vna1vgv
SHA256 f78a5acdc8a56a09b6e77258c478ec025b33e10c2b9bc293e57c8fc5911c36e8
MD5 23b59cf8fe1d58bbb173da968b7918a2
SHA1 d8fae21b88376acb1f18a1b293de008abdb932d2
SHA512 ae4b0920b49593eee08f0fe0a98135089f4715d8ce575a3ad1c4e331a63010a10cfd6a9bf255bb5343a23eacef9c8186ad67a367a6dfaa6ade8753858a7154e6
SSDEEP 3072:GyR836hHEgAyQIrIjibSJKbsQvVqRlkM4OAD/KLznBuB2JA2BjWGNoj:GyR8365EvLjkbsQvMRlkM4RD/qzMfUzW
TLSH
T18904CE123B51D3FED4100830305EA7411AE9FE3D066F6593F7423A561E3D3D6AA6AA1F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-09_23b59cf8fe1d58bbb173da968b7918a2_amadey_elex_floxif_redline-stealer_rhadamanthys_smoke-loader_stop
- Size 178KB
- SHA256 f78a5acdc8a56a09b6e77258c478ec025b33e10c2b9bc293e57c8fc5911c36e8
- MD5 23b59cf8fe1d58bbb173da968b7918a2
- SHA1 d8fae21b88376acb1f18a1b293de008abdb932d2
- SHA512 ae4b0920b49593eee08f0fe0a98135089f4715d8ce575a3ad1c4e331a63010a10cfd6a9bf255bb5343a23eacef9c8186ad67a367a6dfaa6ade8753858a7154e6
- SSDEEP 3072:GyR836hHEgAyQIrIjibSJKbsQvVqRlkM4OAD/KLznBuB2JA2BjWGNoj:GyR8365EvLjkbsQvMRlkM4RD/qzMfUzW
- TLSH
  T18904CE123B51D3FED4100830305EA7411AE9FE3D066F6593F7423A561E3D3D6AA6AA1F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor defense_evasion discovery floxif persistence privilege_escalation trojan upx
- Family: Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Modifies visibility of file extensions in Explorer
  defense_evasion
- Modifies visibility of hidden/system files in Explorer
  defense_evasion
- Detects Floxif payload
  backdoor
- UPX dump on OEP (original entry point)
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Network Service Discovery
  Attempt to gather information on host's network.
  discovery
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2