floxif | 8ac81ef6b236fcd1a310f8b6ea6030daf671a573a86eb1dc6260caf1e7d61b06

General

Target
2026-08-19_8ccddb484236b73c794f56e222cec320_coinminer_elex_floxif
Size 523KB
Sample260820-b1ehcsah35
SHA256 8ac81ef6b236fcd1a310f8b6ea6030daf671a573a86eb1dc6260caf1e7d61b06
MD5 8ccddb484236b73c794f56e222cec320
SHA1 4c2006fb113d550ff34fc4bc7c5f02254a1cc08d
SHA512 ab553575ddc1d3d82acaa12c3f591126a9ac52dfe5ca00d07c5d244d28719be57919793750f910f24f64530c5cf67b89675cf96a3143130c48ced2d5d0794370
SSDEEP 12288:Viwcn7EanlQiWtYhmJKSwUBLcQZfgi5BjvrEH7XX:3cn7NlwiUbrEH7H
TLSH
T1FEB41280A6045BEDD5160334BA7F3FA38DF19DBE196F0196C27A385A7D7D903128CA1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-19_8ccddb484236b73c794f56e222cec320_coinminer_elex_floxif
- Size 523KB
- SHA256 8ac81ef6b236fcd1a310f8b6ea6030daf671a573a86eb1dc6260caf1e7d61b06
- MD5 8ccddb484236b73c794f56e222cec320
- SHA1 4c2006fb113d550ff34fc4bc7c5f02254a1cc08d
- SHA512 ab553575ddc1d3d82acaa12c3f591126a9ac52dfe5ca00d07c5d244d28719be57919793750f910f24f64530c5cf67b89675cf96a3143130c48ced2d5d0794370
- SSDEEP 12288:Viwcn7EanlQiWtYhmJKSwUBLcQZfgi5BjvrEH7XX:3cn7NlwiUbrEH7H
- TLSH
  T1FEB41280A6045BEDD5160334BA7F3FA38DF19DBE196F0196C27A385A7D7D903128CA1B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor discovery floxif persistence privilege_escalation trojan upx adware defense_evasion evasion execution spyware
- Family: Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender TamperProtection settings
  evasion trojan
- Modifies firewall policy service
  defense_evasion
- Modifies security service
  defense_evasion
- Windows security bypass
  defense_evasion trojan
- Detects Floxif payload
  backdoor
- UPX dump on OEP (original entry point)
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Loads dropped DLL
- Windows security modification
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  remove IFEO.
  defense_evasion
- Modifies Security services
  Modifies the startup behavior of a security service.
  defense_evasion
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2