floxif | 2457e731103a752b3b77616e9a799134434bec09bf898819e35b246868721745

General

Target
2026-08-13_d4195c17fe9546109980e9e5b89a68e6_driverpack_elex_floxif_wannacry
Size 12.0MB
Sample260813-tyqfystfph
SHA256 2457e731103a752b3b77616e9a799134434bec09bf898819e35b246868721745
MD5 d4195c17fe9546109980e9e5b89a68e6
SHA1 59bf0676659d8b361e3c39391685d86a18ca9b03
SHA512 eb89cd45597f93388a2d477215de65f9de532ae506bce5bb9788bc5ba01149b994e384167a4ee2cda4ea8e62162e9a7effc0ccb79c76d2fc45295a1d690c15ef
SSDEEP 196608:65PFyKZWjD7lWtWvqQlVFfbKW/S0I2ZcQ2BQeqhXlo7dFrnRqQ6VuSmT1p2:65PWD78tWCgzKOS0IkcDqJcnx6V3qp2
TLSH
T1A6C6339077C5F1BDE0A5307231A03B069EE4D67D1BAF25CFABD92318E615393C13269A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-13_d4195c17fe9546109980e9e5b89a68e6_driverpack_elex_floxif_wannacry
- Size 12.0MB
- SHA256 2457e731103a752b3b77616e9a799134434bec09bf898819e35b246868721745
- MD5 d4195c17fe9546109980e9e5b89a68e6
- SHA1 59bf0676659d8b361e3c39391685d86a18ca9b03
- SHA512 eb89cd45597f93388a2d477215de65f9de532ae506bce5bb9788bc5ba01149b994e384167a4ee2cda4ea8e62162e9a7effc0ccb79c76d2fc45295a1d690c15ef
- SSDEEP 196608:65PFyKZWjD7lWtWvqQlVFfbKW/S0I2ZcQ2BQeqhXlo7dFrnRqQ6VuSmT1p2:65PWD78tWCgzKOS0IkcDqJcnx6V3qp2
- TLSH
  T1A6C6339077C5F1BDE0A5307231A03B069EE4D67D1BAF25CFABD92318E615393C13269A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor discovery floxif persistence privilege_escalation trojan upx defense_evasion spyware
- Family: Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Detects Floxif payload
  backdoor
- UPX dump on OEP (original entry point)
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2