floxif | 20254a41a0f6be3b0d9bfdb619bdb1842c8112625fa49dfc0a8da8a9e331699d

General

Target
2026-08-11_829c9243f4dc4b39a34f98e87672ef24_coinminer_elex_floxif_glassworm_poet-rat_sliver_snatch
Size 16.2MB
Sample260811-vg8rmstxht
SHA256 20254a41a0f6be3b0d9bfdb619bdb1842c8112625fa49dfc0a8da8a9e331699d
MD5 829c9243f4dc4b39a34f98e87672ef24
SHA1 40b4a680fb412b0da6fdb9a7d71cca84788beff6
SHA512 447a54116759683430b3943d1dfb0fd1d199ca259b765db6e4de857e024dfcb739234064bb16b9a6b6e13b2999b1648e8a49157c57f4aa3581344558c9ee895b
SSDEEP 98304:+GdjOEwPuLn8sZLyyuWDJ6tzBYcZtYVCt/vzpeVXK3nEtJFLhXZNP2ftZ/kQNYQ3:+GdSEBoWLyaDEtHHya/vIunIhpIHL3
TLSH
T149076B64E8DF12FADEAA0530AE73223F5334520493ACEDD3D7984913E4B75D6172368A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-11_829c9243f4dc4b39a34f98e87672ef24_coinminer_elex_floxif_glassworm_poet-rat_sliver_snatch
- Size 16.2MB
- SHA256 20254a41a0f6be3b0d9bfdb619bdb1842c8112625fa49dfc0a8da8a9e331699d
- MD5 829c9243f4dc4b39a34f98e87672ef24
- SHA1 40b4a680fb412b0da6fdb9a7d71cca84788beff6
- SHA512 447a54116759683430b3943d1dfb0fd1d199ca259b765db6e4de857e024dfcb739234064bb16b9a6b6e13b2999b1648e8a49157c57f4aa3581344558c9ee895b
- SSDEEP 98304:+GdjOEwPuLn8sZLyyuWDJ6tzBYcZtYVCt/vzpeVXK3nEtJFLhXZNP2ftZ/kQNYQ3:+GdSEBoWLyaDEtHHya/vIunIhpIHL3
- TLSH
  T149076B64E8DF12FADEAA0530AE73223F5334520493ACEDD3D7984913E4B75D6172368A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor discovery floxif trojan upx persistence privilege_escalation
- Family: Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Detects Floxif payload
  backdoor
- UPX dump on OEP (original entry point)
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2