floxif | d22640a02a27bb0c4a54608a17dd4b2fa69761f1db6150331370187814882563

General

Target
2026-08-13_e3c18cd8b56155eb0bdc8a899636e2cd_agent-tesla_backswap_elex_floxif_remcos_stop
Size 921KB
Sample260813-r53nrasckd
SHA256 d22640a02a27bb0c4a54608a17dd4b2fa69761f1db6150331370187814882563
MD5 e3c18cd8b56155eb0bdc8a899636e2cd
SHA1 dc2102e646be9195060eccf9c13d46697e206b8b
SHA512 9198fcb6e6e03f1a44eca43c910610fa67d463ad9f5a7d665f272629e884eb2eb081f1d93a5c591a7133755c279e82d70d5c8efcae5d5f24eda300faf309f12a
SSDEEP 12288:FaWzgMR7v3qnCiSErQoa8h0F4ECJ8lny3Q50IuGpJT+WCfaW8KBuyXLtfBjvrEHT:0aHxv6CarHony3Q50I9Z3o78sXzrEH7v
TLSH
T1BE15DF12B3C681F6D9933875397BE32BEB35621D0327C487A7E12E728F251415B3A762
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-13_e3c18cd8b56155eb0bdc8a899636e2cd_agent-tesla_backswap_elex_floxif_remcos_stop
- Size 921KB
- SHA256 d22640a02a27bb0c4a54608a17dd4b2fa69761f1db6150331370187814882563
- MD5 e3c18cd8b56155eb0bdc8a899636e2cd
- SHA1 dc2102e646be9195060eccf9c13d46697e206b8b
- SHA512 9198fcb6e6e03f1a44eca43c910610fa67d463ad9f5a7d665f272629e884eb2eb081f1d93a5c591a7133755c279e82d70d5c8efcae5d5f24eda300faf309f12a
- SSDEEP 12288:FaWzgMR7v3qnCiSErQoa8h0F4ECJ8lny3Q50IuGpJT+WCfaW8KBuyXLtfBjvrEHT:0aHxv6CarHony3Q50I9Z3o78sXzrEH7v
- TLSH
  T1BE15DF12B3C681F6D9933875397BE32BEB35621D0327C487A7E12E728F251415B3A762
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor discovery floxif persistence privilege_escalation trojan upx
- Family: Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Detects Floxif payload
  backdoor
- UPX dump on OEP (original entry point)
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2