floxif | c817ac55f05a38b6dcdd112d35cd6efbe44f644f2c8718facca57a12b3acc6b9

General

Target
2026-08-14_4b29188244b208b62df0a022f734f51f_amadey_elex_floxif_redline-stealer_smoke-loader_stealc_tofsee
Size 40.2MB
Sample260814-e52p8svcpf
SHA256 c817ac55f05a38b6dcdd112d35cd6efbe44f644f2c8718facca57a12b3acc6b9
MD5 4b29188244b208b62df0a022f734f51f
SHA1 fd638039b96b8a9fe1e8d9b3d61ae8880c8a8a12
SHA512 ae611bf908fa96efff61cd7bf92efaf00405f9932cc6fa4dd7ab6259945e2e2134787e2173685aaddd755348e7cf4701fa8c4d0961f4f8c0c371e307364023d1
SSDEEP 786432:XZ9t/wj1vuNiwKrX5K9y6uXkfAHjn8Mo8i+hNlAv4fRgV/0n2S:PF0ZpuBEkoDnL6+vlxmhs2S
TLSH
T1FF973390374002E2D1F75A31B29290B4A6F527EF613809F18BB675FB54351E27F326BA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-14_4b29188244b208b62df0a022f734f51f_amadey_elex_floxif_redline-stealer_smoke-loader_stealc_tofsee
- Size 40.2MB
- SHA256 c817ac55f05a38b6dcdd112d35cd6efbe44f644f2c8718facca57a12b3acc6b9
- MD5 4b29188244b208b62df0a022f734f51f
- SHA1 fd638039b96b8a9fe1e8d9b3d61ae8880c8a8a12
- SHA512 ae611bf908fa96efff61cd7bf92efaf00405f9932cc6fa4dd7ab6259945e2e2134787e2173685aaddd755348e7cf4701fa8c4d0961f4f8c0c371e307364023d1
- SSDEEP 786432:XZ9t/wj1vuNiwKrX5K9y6uXkfAHjn8Mo8i+hNlAv4fRgV/0n2S:PF0ZpuBEkoDnL6+vlxmhs2S
- TLSH
  T1FF973390374002E2D1F75A31B29290B4A6F527EF613809F18BB675FB54351E27F326BA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor discovery floxif persistence privilege_escalation trojan upx
- Family: Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Detects Floxif payload
  backdoor
- UPX dump on OEP (original entry point)
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2