floxif | 6b59f3533e947f222cd2d56ee32669158077677bfea001660d59247b303b75bf

General

Target
2026-08-13_42e0da65f920022baaa0579556ea6582_elex_floxif_hijackloader_maze_rhadamanthys_stealc_stop
Size 305KB
Sample260813-sts6lsstet
SHA256 6b59f3533e947f222cd2d56ee32669158077677bfea001660d59247b303b75bf
MD5 42e0da65f920022baaa0579556ea6582
SHA1 45cef5d2c31d40d025a9faef3b5b67dba4999b3d
SHA512 4bd057946e5596980126b6d5a6d5a6932fc3345707909f9ae1adc9c07c230fafe3f088830e4a9cf99f9d5a64710332a9d54828a343a6beaa870dd00622085209
SSDEEP 3072:1N2G3ZoSadgubh/ep+ThZoS0JCGd12z7mF2lQBV+UdE+rECWp7hKKTM:D2GpzobxepU7GmGBV+UdvrEFp7hKKA
TLSH
T142647B1131C087F4D472013324AB962D76F9FD3D4F6A4A8BB398BACD0A7CD925739662
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-13_42e0da65f920022baaa0579556ea6582_elex_floxif_hijackloader_maze_rhadamanthys_stealc_stop
- Size 305KB
- SHA256 6b59f3533e947f222cd2d56ee32669158077677bfea001660d59247b303b75bf
- MD5 42e0da65f920022baaa0579556ea6582
- SHA1 45cef5d2c31d40d025a9faef3b5b67dba4999b3d
- SHA512 4bd057946e5596980126b6d5a6d5a6932fc3345707909f9ae1adc9c07c230fafe3f088830e4a9cf99f9d5a64710332a9d54828a343a6beaa870dd00622085209
- SSDEEP 3072:1N2G3ZoSadgubh/ep+ThZoS0JCGd12z7mF2lQBV+UdE+rECWp7hKKTM:D2GpzobxepU7GmGBV+UdvrEFp7hKKA
- TLSH
  T142647B1131C087F4D472013324AB962D76F9FD3D4F6A4A8BB398BACD0A7CD925739662
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor discovery floxif trojan upx persistence privilege_escalation
- Family: Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Detects Floxif payload
  backdoor
- UPX dump on OEP (original entry point)
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2