floxif | a21c10fbbb933bb17932d13f0720194e3435214eead3a85c6e242c3910ea3841

General

Target
2026-08-16_e4e4c4252bf7b9a657764817ffdea3c3_elex_emotet_floxif_stop_swisyn
Size 4.3MB
Sample260816-g1bpcsssd1
SHA256 a21c10fbbb933bb17932d13f0720194e3435214eead3a85c6e242c3910ea3841
MD5 e4e4c4252bf7b9a657764817ffdea3c3
SHA1 ae66539cd74eee191e276fedc7778949e283fc66
SHA512 83f969e30482c9079993e9fe18d8f057759ca372cdbeef4f1dcc646251dbec7b14259e94961cf8e518434d74c8551d88c8b8efb130f99df794c2a035cb4e7485
SSDEEP 98304:Ay7Q3a4t3uFgGZLXRmwv9Sx8plpsxilrJSPNQ7Ql6:Ay7Q3a4QFgahmM9Sx27sKSO7i6
TLSH
T1E626294FEB00B24AC41604F0242D17A762DD7A726D683C9FA7809A295FFC5F7DA52E43
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-16_e4e4c4252bf7b9a657764817ffdea3c3_elex_emotet_floxif_stop_swisyn
- Size 4.3MB
- SHA256 a21c10fbbb933bb17932d13f0720194e3435214eead3a85c6e242c3910ea3841
- MD5 e4e4c4252bf7b9a657764817ffdea3c3
- SHA1 ae66539cd74eee191e276fedc7778949e283fc66
- SHA512 83f969e30482c9079993e9fe18d8f057759ca372cdbeef4f1dcc646251dbec7b14259e94961cf8e518434d74c8551d88c8b8efb130f99df794c2a035cb4e7485
- SSDEEP 98304:Ay7Q3a4t3uFgGZLXRmwv9Sx8plpsxilrJSPNQ7Ql6:Ay7Q3a4QFgahmM9Sx27sKSO7i6
- TLSH
  T1E626294FEB00B24AC41604F0242D17A762DD7A726D683C9FA7809A295FFC5F7DA52E43
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor defense_evasion discovery floxif persistence trojan upx privilege_escalation
- Family: Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Modifies visibility of hidden/system files in Explorer
  defense_evasion
- Detects Floxif payload
  backdoor
- UPX dump on OEP (original entry point)
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2