floxif | a0b27afb94e11950a7dc9c35e8a2c069a68e7621b986f58c19985bd047bfa86d

General

Target
2026-08-21_3c28a822318a6782492117abd0cdfaf7_elex_floxif_wannacry
Size 30.1MB
Sample260822-tw78zshr6v
SHA256 a0b27afb94e11950a7dc9c35e8a2c069a68e7621b986f58c19985bd047bfa86d
MD5 3c28a822318a6782492117abd0cdfaf7
SHA1 af7316261b6c74532adc8e50cc4a153892e203f7
SHA512 db520690dd75f1f929f1e82a0216c131620a030e066c66ea8d231640cef3ae529ac77fd2defc3ed519757f308934e23e527d72193ee44a3d769cf0f296bf9a6b
SSDEEP 786432:aJVdGL3z5NXeyQIwJtNYUJwif0nOJa9WEWRIOG5B7DVGLhYNBFv3cnZCQ:2jOLXelIMjJwi0wMVW6n7ShYWCQ
TLSH
T1146733B51848C5BCE7E0B1F0080AF5A176DAF9BCE9C5CC46B1F4BC99919E4618FE612C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-21_3c28a822318a6782492117abd0cdfaf7_elex_floxif_wannacry
- Size 30.1MB
- SHA256 a0b27afb94e11950a7dc9c35e8a2c069a68e7621b986f58c19985bd047bfa86d
- MD5 3c28a822318a6782492117abd0cdfaf7
- SHA1 af7316261b6c74532adc8e50cc4a153892e203f7
- SHA512 db520690dd75f1f929f1e82a0216c131620a030e066c66ea8d231640cef3ae529ac77fd2defc3ed519757f308934e23e527d72193ee44a3d769cf0f296bf9a6b
- SSDEEP 786432:aJVdGL3z5NXeyQIwJtNYUJwif0nOJa9WEWRIOG5B7DVGLhYNBFv3cnZCQ:2jOLXelIMjJwi0wMVW6n7ShYWCQ
- TLSH
  T1146733B51848C5BCE7E0B1F0080AF5A176DAF9BCE9C5CC46B1F4BC99919E4618FE612C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor discovery execution floxif persistence ransomware trojan upx
- Family: Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Detects Floxif payload
  backdoor
- UPX dump on OEP (original entry point)
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
- Executes a VBScript file via the Windows Script Host.
  execution
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2