floxif | 2d15ad661188b1df75be4ddd70d7d74d9d10cf0752645599bc6f7f4cbce73fd0

General

Target
2026-08-17_b4af5a5fd9fc5ef87a6e2796200f8270_amadey_elex_floxif_rhadamanthys_smoke-loader
Size 48.2MB
Sample260817-cb7chs1ye1
SHA256 2d15ad661188b1df75be4ddd70d7d74d9d10cf0752645599bc6f7f4cbce73fd0
MD5 b4af5a5fd9fc5ef87a6e2796200f8270
SHA1 556fc10a038aaf44f1655fa6b9c296f5aa130471
SHA512 80dbe0e714af8dd00a087b500e9dea259c0bd42e317fd0b1e21588c4a9493209f6a2e073e87e8a8e1c5d39a42406a27e7a345d46910832c6ef0c4e1cde96eb43
SSDEEP 1572864:MAVBjIQSzQe3cf7xOCHKYrLn+XxdjrALIjOqWY99f:lVBIbzQe3u7KYrCDS9299f
TLSH
T14AB733E171D48AB0C9932ABA03D973B44FF26D6F1BBCA9EBBD4447E1910495293B1F04
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-17_b4af5a5fd9fc5ef87a6e2796200f8270_amadey_elex_floxif_rhadamanthys_smoke-loader
- Size 48.2MB
- SHA256 2d15ad661188b1df75be4ddd70d7d74d9d10cf0752645599bc6f7f4cbce73fd0
- MD5 b4af5a5fd9fc5ef87a6e2796200f8270
- SHA1 556fc10a038aaf44f1655fa6b9c296f5aa130471
- SHA512 80dbe0e714af8dd00a087b500e9dea259c0bd42e317fd0b1e21588c4a9493209f6a2e073e87e8a8e1c5d39a42406a27e7a345d46910832c6ef0c4e1cde96eb43
- SSDEEP 1572864:MAVBjIQSzQe3cf7xOCHKYrLn+XxdjrALIjOqWY99f:lVBIbzQe3u7KYrCDS9299f
- TLSH
  T14AB733E171D48AB0C9932ABA03D973B44FF26D6F1BBCA9EBBD4447E1910495293B1F04
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor discovery floxif persistence privilege_escalation trojan upx
- Family: Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Detects Floxif payload
  backdoor
- UPX dump on OEP (original entry point)
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2