floxif | 700a3bee9682fab051fc7240fe47ac8ed25d7a376d9ea8b0dbdf82a14be1d60e

General

Target
2026-08-15_a5f891d5138a99a42b810d06c6d31d78_amadey_elex_floxif_smoke-loader_stealc_stop_tofsee
Size 4.3MB
Sample260815-tyrn1szdlf
SHA256 700a3bee9682fab051fc7240fe47ac8ed25d7a376d9ea8b0dbdf82a14be1d60e
MD5 a5f891d5138a99a42b810d06c6d31d78
SHA1 bf1d99deb2b5bbd31f057cc04810ba17750154db
SHA512 2d08f67bee90c8684dadd5fd088598bbeb909ea36602d1333818be9b1115e9db5aa2e4a955182d4360dfef63f760378f41e55a6e09ba73c290e5166cf182d880
SSDEEP 98304:1l4gSfW7P8INuKoc8M7HRy06bKReWiG59FefAKKsPSTXZRa:wu7P8ID8Mg06+ReWiy9cTWfa
TLSH
T13B26339332D4C3F5E462843534A45B2098B5ED3C4277AA49BF90360ABF7D7A2C35A71B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-15_a5f891d5138a99a42b810d06c6d31d78_amadey_elex_floxif_smoke-loader_stealc_stop_tofsee
- Size 4.3MB
- SHA256 700a3bee9682fab051fc7240fe47ac8ed25d7a376d9ea8b0dbdf82a14be1d60e
- MD5 a5f891d5138a99a42b810d06c6d31d78
- SHA1 bf1d99deb2b5bbd31f057cc04810ba17750154db
- SHA512 2d08f67bee90c8684dadd5fd088598bbeb909ea36602d1333818be9b1115e9db5aa2e4a955182d4360dfef63f760378f41e55a6e09ba73c290e5166cf182d880
- SSDEEP 98304:1l4gSfW7P8INuKoc8M7HRy06bKReWiG59FefAKKsPSTXZRa:wu7P8ID8Mg06+ReWiy9cTWfa
- TLSH
  T13B26339332D4C3F5E462843534A45B2098B5ED3C4277AA49BF90360ABF7D7A2C35A71B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor discovery floxif persistence privilege_escalation trojan upx
- Family: Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Detects Floxif payload
  backdoor
- UPX dump on OEP (original entry point)
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2