floxif | 7d4f748d9f86175248505c58f149e7363739decb0cd876a95e6f44ef49ab09e1

General

Target
2026-08-17_d17398aa5a0197f4905bb749ca7ed4ac_amadey_darkgate_elex_floxif_rhadamanthys_smoke-loader
Size 48.1MB
Sample260817-b8pnasgh97
SHA256 7d4f748d9f86175248505c58f149e7363739decb0cd876a95e6f44ef49ab09e1
MD5 d17398aa5a0197f4905bb749ca7ed4ac
SHA1 f483fd8aefd627633d7b39d126adfc2503334ab8
SHA512 eab5219c9af1210d12ff4b3d09ba7053cd19e7222a632be9d28cd93ca9d3f6cd8b292b9af317c22ab486797b9fdeb71e2417dbd7823d6fda8370f37eaaf7452d
SSDEEP 1572864:mkekSjofjyjsUSnSTt2mjN6LIFTtAmriZnO:YkSjobmsUQC0mjN6QbsO
TLSH
T1CAB73337C3A1976BC07222FD119DE594A866F4B48B1C43EFB3018E856C6EA66277D703
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-17_d17398aa5a0197f4905bb749ca7ed4ac_amadey_darkgate_elex_floxif_rhadamanthys_smoke-loader
- Size 48.1MB
- SHA256 7d4f748d9f86175248505c58f149e7363739decb0cd876a95e6f44ef49ab09e1
- MD5 d17398aa5a0197f4905bb749ca7ed4ac
- SHA1 f483fd8aefd627633d7b39d126adfc2503334ab8
- SHA512 eab5219c9af1210d12ff4b3d09ba7053cd19e7222a632be9d28cd93ca9d3f6cd8b292b9af317c22ab486797b9fdeb71e2417dbd7823d6fda8370f37eaaf7452d
- SSDEEP 1572864:mkekSjofjyjsUSnSTt2mjN6LIFTtAmriZnO:YkSjobmsUQC0mjN6QbsO
- TLSH
  T1CAB73337C3A1976BC07222FD119DE594A866F4B48B1C43EFB3018E856C6EA66277D703
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor discovery floxif persistence privilege_escalation trojan upx
- Family: Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Detects Floxif payload
  backdoor
- UPX dump on OEP (original entry point)
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2