floxif | 2938116aef73aca5fc000c3eb775cee7ec0d8a108c588d5bf58eec2c8c771407

General

Target
2026-08-09_aba286f3b2b3ff0249032130fc14efaa_akira_amadey_blankgrabber_elex_floxif_icedid_luca-stealer_njrat_smoke-loader_stealc
Size 7.3MB
Sample260809-q6esmsssfx
SHA256 2938116aef73aca5fc000c3eb775cee7ec0d8a108c588d5bf58eec2c8c771407
MD5 aba286f3b2b3ff0249032130fc14efaa
SHA1 83340b446a58bc6acbd13e70a1d99b92340521e2
SHA512 9c473bb0fb8c2650b71fefafa14fe6560bb7bd0bc9861fb71cd8769a01e4b6d5214ad59a1c513893cd566b7051f3ecd5b45a8fa4813be2dd676f13b7e5befd96
SSDEEP 98304:dCbAI4Z1aQ9munyGIPeIQd84vGyBl1IlbcrTLN9:mAHRmAyGIPluGuibcrl9
TLSH
T143769D1272E841E8E1778179895A8A5FDEB5BC120B3152CF329C5B1E1F376D25E3B322
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-09_aba286f3b2b3ff0249032130fc14efaa_akira_amadey_blankgrabber_elex_floxif_icedid_luca-stealer_njrat_smoke-loader_stealc
- Size 7.3MB
- SHA256 2938116aef73aca5fc000c3eb775cee7ec0d8a108c588d5bf58eec2c8c771407
- MD5 aba286f3b2b3ff0249032130fc14efaa
- SHA1 83340b446a58bc6acbd13e70a1d99b92340521e2
- SHA512 9c473bb0fb8c2650b71fefafa14fe6560bb7bd0bc9861fb71cd8769a01e4b6d5214ad59a1c513893cd566b7051f3ecd5b45a8fa4813be2dd676f13b7e5befd96
- SSDEEP 98304:dCbAI4Z1aQ9munyGIPeIQd84vGyBl1IlbcrTLN9:mAHRmAyGIPluGuibcrl9
- TLSH
  T143769D1272E841E8E1778179895A8A5FDEB5BC120B3152CF329C5B1E1F376D25E3B322
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor discovery floxif persistence privilege_escalation spyware stealer trojan upx
- Family: Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Detects Floxif payload
  backdoor
- UPX dump on OEP (original entry point)
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2