floxif | d23e052b7d7dda50db34d4e92a5323fc22cc8b1f5e3b170d040f1e72859dca19

General

Target
2026-08-09_d029657b63396cac204d96dfd0251dfd_elex_floxif_stop
Size 718KB
Sample260809-ws3v7staje
SHA256 d23e052b7d7dda50db34d4e92a5323fc22cc8b1f5e3b170d040f1e72859dca19
MD5 d029657b63396cac204d96dfd0251dfd
SHA1 02f9e62b70f008b595ae6473a700b5a0fb9c3495
SHA512 dadad40d6c3af5506cd844693bd71deea1f0d4f5bbf0ed8029c52895ae7de19d4d816a758a80557267c1e3c9033828edc161b0f192d39f1ac62fdcfbca156373
SSDEEP 12288:8H5ucjdc6r2sxxiPGGAOOPSXDV8ClgVYhX5FSV89iE1KBjvrEH7g:8IK2sObHtqQA89ifrEH7g
TLSH
T150F4BF12F3C741F9D9923874257BE32BDB35762D432BC487EBE12E628E101459B3A366
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-09_d029657b63396cac204d96dfd0251dfd_elex_floxif_stop
- Size 718KB
- SHA256 d23e052b7d7dda50db34d4e92a5323fc22cc8b1f5e3b170d040f1e72859dca19
- MD5 d029657b63396cac204d96dfd0251dfd
- SHA1 02f9e62b70f008b595ae6473a700b5a0fb9c3495
- SHA512 dadad40d6c3af5506cd844693bd71deea1f0d4f5bbf0ed8029c52895ae7de19d4d816a758a80557267c1e3c9033828edc161b0f192d39f1ac62fdcfbca156373
- SSDEEP 12288:8H5ucjdc6r2sxxiPGGAOOPSXDV8ClgVYhX5FSV89iE1KBjvrEH7g:8IK2sObHtqQA89ifrEH7g
- TLSH
  T150F4BF12F3C741F9D9923874257BE32BDB35762D432BC487EBE12E628E101459B3A366
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor discovery execution floxif persistence privilege_escalation trojan upx
- Family: Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Detects Floxif payload
  backdoor
- UPX dump on OEP (original entry point)
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2