floxif | 87e6a039aed23fa3f4bebd81c7bd113c03087f3b44db70f09a3849781cc5c71b

General

Target
2026-08-15_603217e8851fa8069d38afdca9525bcc_darkgate_elex_floxif_rhadamanthys_stop
Size 2.9MB
Sample260815-rmcdvayake
SHA256 87e6a039aed23fa3f4bebd81c7bd113c03087f3b44db70f09a3849781cc5c71b
MD5 603217e8851fa8069d38afdca9525bcc
SHA1 ebc644912c7fcdea174d4739aff5c508a26bc555
SHA512 bacfd75d4969467169f55b876257c25f8746cf308e17c9877a2b2d33d642c5a0b797188be9a5ed333db292694e789646fa8f80433b2ecac2284270feea6a63ae
SSDEEP 49152:5iib/tHbTrazbUR1Vs+fHlvqRaZuqRsuFS9VjBOGsCGegrGVFBu1gr9KS7Om9Bdm:siprazbgZvqRacq2uFMBOGZtbBu1gr9Y
TLSH
T1B4E59D513FC88076C267293791A9A73A71AEBAB12B3091CB66805D3D7D345C3AD3C727
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-15_603217e8851fa8069d38afdca9525bcc_darkgate_elex_floxif_rhadamanthys_stop
- Size 2.9MB
- SHA256 87e6a039aed23fa3f4bebd81c7bd113c03087f3b44db70f09a3849781cc5c71b
- MD5 603217e8851fa8069d38afdca9525bcc
- SHA1 ebc644912c7fcdea174d4739aff5c508a26bc555
- SHA512 bacfd75d4969467169f55b876257c25f8746cf308e17c9877a2b2d33d642c5a0b797188be9a5ed333db292694e789646fa8f80433b2ecac2284270feea6a63ae
- SSDEEP 49152:5iib/tHbTrazbUR1Vs+fHlvqRaZuqRsuFS9VjBOGsCGegrGVFBu1gr9KS7Om9Bdm:siprazbgZvqRacq2uFMBOGZtbBu1gr9Y
- TLSH
  T1B4E59D513FC88076C267293791A9A73A71AEBAB12B3091CB66805D3D7D345C3AD3C727
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor discovery floxif trojan upx persistence privilege_escalation
- Family: Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Detects Floxif payload
  backdoor
- UPX dump on OEP (original entry point)
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2