floxif | 1dc064bc7dbe1e385f34d7e1c1714c62e2362a9bfa3d57325294935d81bffd68

General

Target
2026-09-19_b7143d93a58a1e40bfd5a48db3c92e12_amadey_elex_floxif_redline-stealer_smoke-loader_stealc_tofsee
Size 5.6MB
Sample260919-1dg3eaytev
SHA256 1dc064bc7dbe1e385f34d7e1c1714c62e2362a9bfa3d57325294935d81bffd68
MD5 b7143d93a58a1e40bfd5a48db3c92e12
SHA1 e61c2a98da60ed29397b500a26a209321a463ea0
SHA512 7ea03d222c29d111c774437c187a67d683805c9cf6702d21517ac85eadfc967efc4b36eb681c49433814767235188dc22511d2f9f266c60b9809dcced27680b2
SSDEEP 98304:nL3sRduIJ5Ccc9LVKGvIm8ZcYm3wxzmYZnq6KBasnDo7E1wtUJeLthEina:L8Rd5spuOYmAxjhED0oQqeDEina
TLSH
T10D56330627F0C77AD8E30270382836F05CF56E6D17B1938BFB94570A292EBD1D69925B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-09-19_b7143d93a58a1e40bfd5a48db3c92e12_amadey_elex_floxif_redline-stealer_smoke-loader_stealc_tofsee
- Size 5.6MB
- SHA256 1dc064bc7dbe1e385f34d7e1c1714c62e2362a9bfa3d57325294935d81bffd68
- MD5 b7143d93a58a1e40bfd5a48db3c92e12
- SHA1 e61c2a98da60ed29397b500a26a209321a463ea0
- SHA512 7ea03d222c29d111c774437c187a67d683805c9cf6702d21517ac85eadfc967efc4b36eb681c49433814767235188dc22511d2f9f266c60b9809dcced27680b2
- SSDEEP 98304:nL3sRduIJ5Ccc9LVKGvIm8ZcYm3wxzmYZnq6KBasnDo7E1wtUJeLthEina:L8Rd5spuOYmAxjhED0oQqeDEina
- TLSH
  T10D56330627F0C77AD8E30270382836F05CF56E6D17B1938BFB94570A292EBD1D69925B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor discovery floxif persistence privilege_escalation trojan upx
- Family: Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Detects Floxif payload
  backdoor
- UPX dump on OEP (original entry point)
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2