floxif | 4332e4fc993207295c527ca3576e159475009d53932001376d7d15669b0f919d

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 16:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_48f099c8b5deafa3b237bce444b057e3_amadey_coinminer_elex_floxif_glassworm_luca-stealer_njra.exe
Size 2.9MB
Sample260809-vemfmasckc
SHA256 4332e4fc993207295c527ca3576e159475009d53932001376d7d15669b0f919d
MD5 48f099c8b5deafa3b237bce444b057e3
SHA1 76281a282ec9248a536f64a5f33f04a20bcc72c6
SHA512 d96e613397c655185cf857cd50be9329fcd5e3f29a54476e29ee7ff5338a962d87d5772c7f065595fef1360323a5a5cf72f9b9fca27b128e35ec1a04d29b5543
SSDEEP 49152:FWvLKJyRbwrdGxXFh00KLln1VT/R2tNKfLWyEEstPG3kZ6p5DmfNFlNhCzKQnUrR:FWvZbSG1Fh00KLln1VTp2t2LWmsY3kZ9
TLSH
T113E5BE12FA4149BDEAD21174E2EF537A49396F20033588C797D03FA998325D2BB3E395
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor floxif trojan upx

Malware Config

Signatures

Family: Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
backdoor trojan floxif

Detects Floxif payload 1 IoCs

backdoor

resource	yara_rule
behavioral1/files/0x000c00000002464e-1.dat	floxif

UPX dump on OEP (original entry point) 3 IoCs

resource	yara_rule
behavioral1/files/0x000c00000002464e-1.dat	UPX
behavioral1/memory/2552-3-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral1/memory/2552-8-0x0000000010000000-0x0000000010030000-memory.dmp	UPX

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x000c00000002464e-1.dat	acprotect

Loads dropped DLL 1 IoCs

pid	Process
2552	2026-08-09_48f099c8b5deafa3b237bce444b057e3_amadey_coinminer_elex_floxif_glassworm_luca-stealer_njra.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000c00000002464e-1.dat	upx
behavioral1/memory/2552-3-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2552-8-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\symsrv.dll	2026-08-09_48f099c8b5deafa3b237bce444b057e3_amadey_coinminer_elex_floxif_glassworm_luca-stealer_njra.exe

Program crash 5 IoCs

pid	pid_target	Process	procid_target
700	2552	WerFault.exe	85
6140	2552	WerFault.exe	85
3864	2552	WerFault.exe	85
6052	2552	WerFault.exe	85
1692	2552	WerFault.exe	85

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2552	2026-08-09_48f099c8b5deafa3b237bce444b057e3_amadey_coinminer_elex_floxif_glassworm_luca-stealer_njra.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-09_48f099c8b5deafa3b237bce444b057e3_amadey_coinminer_elex_floxif_glassworm_luca-stealer_njra.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_48f099c8b5deafa3b237bce444b057e3_amadey_coinminer_elex_floxif_glassworm_luca-stealer_njra.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:2552
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2552 -s 524
  2⤵
  - Program crash
  PID:700
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2552 -s 528
  2⤵
  - Program crash
  PID:6140
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2552 -s 524
  2⤵
  - Program crash
  PID:3864
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2552 -s 580
  2⤵
  - Program crash
  PID:6052
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2552 -s 608
  2⤵
  - Program crash
  PID:1692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2552 -ip 2552
1⤵
PID:368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2552 -ip 2552
1⤵
PID:4500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2552 -ip 2552
1⤵
PID:5912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2552 -ip 2552
1⤵
PID:1824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 124 -p 2552 -ip 2552
1⤵
PID:888

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

symsrv.dll

Path C:\Program Files\Common Files\System\symsrv.dll
Size 67KB
SHA256 de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
MD5 7574cf2c64f35161ab1292e2f532aabf
SHA1 14ba3fa927a06224dfe587014299e834def4644f
SHA512 4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab
SSDEEP 1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7ZL:c8y93KQjy7G55riF1cMo03V
TLSH
T17863F1372AB5807DDD210D37949F835AB771E5A76C20643FC25907D988B8DD0E3239AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2552-3-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/2552-5-0x00000000004A5000-0x00000000004A6000-memory.dmp

Download

memory/2552-8-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/2552-6-0x0000000000460000-0x00000000007B9000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads