floxif | 34dc24d2669802bb5ba44089a5befeab46b0ed111652110170bcfac1318c9ef4

General

Target
2026-08-17_2c933d27c41d36cf5b44042889883e5f_coinminer_elex_floxif_wannacry
Size 3.5MB
Sample260817-ct4dkssset
SHA256 34dc24d2669802bb5ba44089a5befeab46b0ed111652110170bcfac1318c9ef4
MD5 2c933d27c41d36cf5b44042889883e5f
SHA1 6d732f4dc52e8982318920f7e3bed56ce7b10415
SHA512 5b77197a103b5e2dc96b8580e1fc35d09b456746255bae3302840ad7dccc4a9cf313d8f9a94e2384dbf2a74a94239e2ea60211acb070ba5748d09930f3505bf0
SSDEEP 98304:i+2eh9mRbS5G2wUDBUz8wLXJ4FtNkggh0YPSq8JeN3q:iDW2bS53wUtUzRikgbZq8JeN6
TLSH
T101063383B9E003FCDEF205757E85B690A5E6AE7D121D0F87E70938082FBC1466B96166
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-17_2c933d27c41d36cf5b44042889883e5f_coinminer_elex_floxif_wannacry
- Size 3.5MB
- SHA256 34dc24d2669802bb5ba44089a5befeab46b0ed111652110170bcfac1318c9ef4
- MD5 2c933d27c41d36cf5b44042889883e5f
- SHA1 6d732f4dc52e8982318920f7e3bed56ce7b10415
- SHA512 5b77197a103b5e2dc96b8580e1fc35d09b456746255bae3302840ad7dccc4a9cf313d8f9a94e2384dbf2a74a94239e2ea60211acb070ba5748d09930f3505bf0
- SSDEEP 98304:i+2eh9mRbS5G2wUDBUz8wLXJ4FtNkggh0YPSq8JeN3q:iDW2bS53wUtUzRikgbZq8JeN6
- TLSH
  T101063383B9E003FCDEF205757E85B690A5E6AE7D121D0F87E70938082FBC1466B96166
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor bootkit discovery floxif persistence trojan upx privilege_escalation
- Family: Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Detects Floxif payload
  backdoor
- UPX dump on OEP (original entry point)
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2