floxif | 1eff48efef695b3426694bd317b2dec8e4d6f640a4e77229fd447e6a3af66519

General

Target
2026-08-25_a8596fca630ac680569bb4796bcda4df_amadey_elex_floxif_rhadamanthys_smoke-loader_stop
Size 409KB
Sample260826-rmqapsxya1
SHA256 1eff48efef695b3426694bd317b2dec8e4d6f640a4e77229fd447e6a3af66519
MD5 a8596fca630ac680569bb4796bcda4df
SHA1 38648fffde41b52c4427965e8bde5869e95da62a
SHA512 9bc616af1b235e4458326a6658f6a7eceb61b7803c922634a9fe94cfa82fa97bd8d7c21240f6d1f1e38f52f6f27920cab3e1b5489df7ae620891eda937a655fa
SSDEEP 12288:0vqSyJda/idZAuYL901/gWxiEGw4BjvrEH7/:UUJda4bY+oGiiKrEH7/
TLSH
T1CF94BF113790CBF7C25230363499E77532EAB5395B2683C777501B6E9E386E29A3831B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-25_a8596fca630ac680569bb4796bcda4df_amadey_elex_floxif_rhadamanthys_smoke-loader_stop
- Size 409KB
- SHA256 1eff48efef695b3426694bd317b2dec8e4d6f640a4e77229fd447e6a3af66519
- MD5 a8596fca630ac680569bb4796bcda4df
- SHA1 38648fffde41b52c4427965e8bde5869e95da62a
- SHA512 9bc616af1b235e4458326a6658f6a7eceb61b7803c922634a9fe94cfa82fa97bd8d7c21240f6d1f1e38f52f6f27920cab3e1b5489df7ae620891eda937a655fa
- SSDEEP 12288:0vqSyJda/idZAuYL901/gWxiEGw4BjvrEH7/:UUJda4bY+oGiiKrEH7/
- TLSH
  T1CF94BF113790CBF7C25230363499E77532EAB5395B2683C777501B6E9E386E29A3831B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor discovery floxif persistence privilege_escalation trojan upx
- Family: Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Detects Floxif payload
  backdoor
- UPX dump on OEP (original entry point)
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2