floxif | fef965c1ee06b9a20d7dd5f80a5ac9eb66dd0b959f5ea7a377b90040d9a97de2

General

Target
2026-08-11_30bd3596aebaccaeab5e6dcb4202b197_amadey_elex_floxif_rhadamanthys_smoke-loader_stop
Size 40.0MB
Sample260811-2xx4eaen4s
SHA256 fef965c1ee06b9a20d7dd5f80a5ac9eb66dd0b959f5ea7a377b90040d9a97de2
MD5 30bd3596aebaccaeab5e6dcb4202b197
SHA1 e03dcee8dd4abf15617e73cf9e75472fd20c47ea
SHA512 5b1e4c5e331499c136517f6b9e738996cd3e2303f22958e9830fe8f52d3ff471621f4f7c67b7e49f3ab35655e29fee216fb47d97bf8b0a1356979cc7ef921c2b
SSDEEP 786432:ypGoHCbrFwMp9H25FtfGhJ4wNvMpZzSPwjs9jNdpS1o0KO:yPinmMeQhJhCV49hG1oc
TLSH
T13797330432EFE5D3F52FAC32642552C2EBD5D6AE153882F70D4A6A8857BFE210F7A114
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-11_30bd3596aebaccaeab5e6dcb4202b197_amadey_elex_floxif_rhadamanthys_smoke-loader_stop
- Size 40.0MB
- SHA256 fef965c1ee06b9a20d7dd5f80a5ac9eb66dd0b959f5ea7a377b90040d9a97de2
- MD5 30bd3596aebaccaeab5e6dcb4202b197
- SHA1 e03dcee8dd4abf15617e73cf9e75472fd20c47ea
- SHA512 5b1e4c5e331499c136517f6b9e738996cd3e2303f22958e9830fe8f52d3ff471621f4f7c67b7e49f3ab35655e29fee216fb47d97bf8b0a1356979cc7ef921c2b
- SSDEEP 786432:ypGoHCbrFwMp9H25FtfGhJ4wNvMpZzSPwjs9jNdpS1o0KO:yPinmMeQhJhCV49hG1oc
- TLSH
  T13797330432EFE5D3F52FAC32642552C2EBD5D6AE153882F70D4A6A8857BFE210F7A114
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor discovery floxif persistence privilege_escalation trojan upx ransomware
- Family: Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Detects Floxif payload
  backdoor
- UPX dump on OEP (original entry point)
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2