floxif | 7976cb2356cd2348de019e0eb84874d05eeaf8606e231a39b515d6e26740b2bb

General

Target
2026-08-16_f09af2e6fa5b781abb74ddbe8a17a614_bkransomware_darkgate_elex_floxif_maze
Size 25.4MB
Sample260816-tzqs4ssvfs
SHA256 7976cb2356cd2348de019e0eb84874d05eeaf8606e231a39b515d6e26740b2bb
MD5 f09af2e6fa5b781abb74ddbe8a17a614
SHA1 c531492017762069ce4a20b568832bdc8b6a88f7
SHA512 90d2541373b13b0a5237e8564c267cf5d00e29fd4ac32de6eddc10b430e11e1a99415aaa4a1b9308271daadd0bc9ba51995529c83c6b192436764f3a8fca0155
SSDEEP 786432:/sn4jAysYqoGTBt3FjRNCr5uqym/j8jC4Xl2SkKQP:/sn4jA7YqoG3VjfCcv7jC4sSkhP
TLSH
T14847333275D184F6D43322719ADE772862F8BE701A35025723D63F2E1DB51C3A639AA3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-16_f09af2e6fa5b781abb74ddbe8a17a614_bkransomware_darkgate_elex_floxif_maze
- Size 25.4MB
- SHA256 7976cb2356cd2348de019e0eb84874d05eeaf8606e231a39b515d6e26740b2bb
- MD5 f09af2e6fa5b781abb74ddbe8a17a614
- SHA1 c531492017762069ce4a20b568832bdc8b6a88f7
- SHA512 90d2541373b13b0a5237e8564c267cf5d00e29fd4ac32de6eddc10b430e11e1a99415aaa4a1b9308271daadd0bc9ba51995529c83c6b192436764f3a8fca0155
- SSDEEP 786432:/sn4jAysYqoGTBt3FjRNCr5uqym/j8jC4Xl2SkKQP:/sn4jA7YqoG3VjfCcv7jC4sSkhP
- TLSH
  T14847333275D184F6D43322719ADE772862F8BE701A35025723D63F2E1DB51C3A639AA3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor defense_evasion discovery floxif ransomware trojan upx persistence privilege_escalation
- Family: Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Detects Floxif payload
  backdoor
- UPX dump on OEP (original entry point)
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2