floxif | 12d11a314bf1fd08aba5af74cb657dacc92c0983f7fe70bc0efc5d10de65640e

General

Target
2026-08-13_a833b35187b94fb5f48f7ff2e65df6fe_amadey_elex_floxif_redline-stealer_smoke-loader_stealc_tofsee
Size 40.2MB
Sample260813-sdr9dabl2v
SHA256 12d11a314bf1fd08aba5af74cb657dacc92c0983f7fe70bc0efc5d10de65640e
MD5 a833b35187b94fb5f48f7ff2e65df6fe
SHA1 83a7093c3fe9fe00a419f5560509d9ad5dab2f99
SHA512 f1f24df5373996090b19c3db32b030a09e10d4cf79f8a4dcd1e5689879be5df4ec318f757de3c245622c0433e2b4fe0456476c323a597d5ca904d136b4aa6837
SSDEEP 786432:HA/S7gkBNoCy+Et2+P/kgNs1m2rweMXRClT5XT90EOf593w5CGWlMaO5wSFPHnjk:zs9Cy+C2K3uwzXRWT5XTCEOfTWr0MaR9
TLSH
T118973305F2EC87B3D2070774DAF55A914434DA0F30B72698F92E5B8095AE07E6B74AE3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-13_a833b35187b94fb5f48f7ff2e65df6fe_amadey_elex_floxif_redline-stealer_smoke-loader_stealc_tofsee
- Size 40.2MB
- SHA256 12d11a314bf1fd08aba5af74cb657dacc92c0983f7fe70bc0efc5d10de65640e
- MD5 a833b35187b94fb5f48f7ff2e65df6fe
- SHA1 83a7093c3fe9fe00a419f5560509d9ad5dab2f99
- SHA512 f1f24df5373996090b19c3db32b030a09e10d4cf79f8a4dcd1e5689879be5df4ec318f757de3c245622c0433e2b4fe0456476c323a597d5ca904d136b4aa6837
- SSDEEP 786432:HA/S7gkBNoCy+Et2+P/kgNs1m2rweMXRClT5XT90EOf593w5CGWlMaO5wSFPHnjk:zs9Cy+C2K3uwzXRWT5XTCEOfTWr0MaR9
- TLSH
  T118973305F2EC87B3D2070774DAF55A914434DA0F30B72698F92E5B8095AE07E6B74AE3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor discovery floxif persistence privilege_escalation trojan upx defense_evasion
- Family: Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Detects Floxif payload
  backdoor
- UPX dump on OEP (original entry point)
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Checks system information in the registry
  System information is often read in order to detect sandboxing environments.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2