floxif | 894da1891594c2796020b3c28456da1be7b5e08db04c13fbfb85a9c1d62aba44

General

Target
2026-08-22_b4df3ba4cd1f1919845a37e57f6dabbe_amadey_elex_floxif_rhadamanthys_smoke-loader
Size 41.1MB
Sample260823-cgppnaha69
SHA256 894da1891594c2796020b3c28456da1be7b5e08db04c13fbfb85a9c1d62aba44
MD5 b4df3ba4cd1f1919845a37e57f6dabbe
SHA1 dffb6b4b1fa27fb206c24293681774fc053970f4
SHA512 78fdb65e55ca6fdf18c92b188a0a950163da01efaaf2765550660f1244d7c02168d1c82484386601253080d3a756d4ea7bf62b675f25746b0711c7009da2c38b
SSDEEP 786432:120rtPwxD5pJfxAHKJ6ETbpu3bxmdAMsbRAn8RthR65:DrtP4TAHaTEbxmdApA82
TLSH
T147973314A390D7BCC05BE9F4149E603D3BF9FC8663649F8BEB640A5E61DE3C658205CA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-22_b4df3ba4cd1f1919845a37e57f6dabbe_amadey_elex_floxif_rhadamanthys_smoke-loader
- Size 41.1MB
- SHA256 894da1891594c2796020b3c28456da1be7b5e08db04c13fbfb85a9c1d62aba44
- MD5 b4df3ba4cd1f1919845a37e57f6dabbe
- SHA1 dffb6b4b1fa27fb206c24293681774fc053970f4
- SHA512 78fdb65e55ca6fdf18c92b188a0a950163da01efaaf2765550660f1244d7c02168d1c82484386601253080d3a756d4ea7bf62b675f25746b0711c7009da2c38b
- SSDEEP 786432:120rtPwxD5pJfxAHKJ6ETbpu3bxmdAMsbRAn8RthR65:DrtP4TAHaTEbxmdApA82
- TLSH
  T147973314A390D7BCC05BE9F4149E603D3BF9FC8663649F8BEB640A5E61DE3C658205CA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor discovery floxif persistence privilege_escalation trojan upx
- Family: Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Detects Floxif payload
  backdoor
- UPX dump on OEP (original entry point)
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2