floxif | 39399c7b3fb26eda5546002b96777db0aa3f5fc0147eaed2103213d0b5336cec

Analysis

max time kernel
149s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/09/2026, 18:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-24_e8ac71d4ca08c521be27de24e2e3b17d_amadey_coinminer_elex_floxif_glassworm_luca-stealer_njra.exe
Size 2.9MB
Sample260924-xj3drayfpg
SHA256 39399c7b3fb26eda5546002b96777db0aa3f5fc0147eaed2103213d0b5336cec
MD5 e8ac71d4ca08c521be27de24e2e3b17d
SHA1 e9f9b656dce2c519fbca7c964ef655b5f68cb64b
SHA512 3cfa3b571d883d00b39a0bcface025bdf743d5069ad5fb9ab2dfd7f48589ea2c534ac3b4e58eceaa4c4635483e51350d4243965a2236cdd2cf7ceb4afcfea0e8
SSDEEP 49152:62v4HNgEH61BDGyKSLNNKoeWhK5tPjBU7GzS5rmjn9lNxV1VB8mB9ws:62vkH6DGXSxNXeWi7U7GzAmx
TLSH
T11CE5AF12FA4149BDE9D25174E2EF537A49396F20033584C797C03FA998326D2BB3E399
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor floxif trojan upx

Malware Config

Signatures

Family: Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
backdoor trojan floxif

Detects Floxif payload 1 IoCs

backdoor

resource	yara_rule
behavioral1/files/0x0002000000022c65-1.dat	floxif

UPX dump on OEP (original entry point) 3 IoCs

resource	yara_rule
behavioral1/files/0x0002000000022c65-1.dat	UPX
behavioral1/memory/4772-3-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral1/memory/4772-8-0x0000000010000000-0x0000000010030000-memory.dmp	UPX

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x0002000000022c65-1.dat	acprotect

Loads dropped DLL 1 IoCs

pid	Process
4772	2026-09-24_e8ac71d4ca08c521be27de24e2e3b17d_amadey_coinminer_elex_floxif_glassworm_luca-stealer_njra.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0002000000022c65-1.dat	upx
behavioral1/memory/4772-3-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/4772-8-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\symsrv.dll	2026-09-24_e8ac71d4ca08c521be27de24e2e3b17d_amadey_coinminer_elex_floxif_glassworm_luca-stealer_njra.exe

Program crash 5 IoCs

pid	pid_target	Process	procid_target
1808	4772	WerFault.exe	84
3116	4772	WerFault.exe	84
2088	4772	WerFault.exe	84
4492	4772	WerFault.exe	84
1728	4772	WerFault.exe	84

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4772	2026-09-24_e8ac71d4ca08c521be27de24e2e3b17d_amadey_coinminer_elex_floxif_glassworm_luca-stealer_njra.exe

C:\Users\Admin\AppData\Local\Temp\2026-09-24_e8ac71d4ca08c521be27de24e2e3b17d_amadey_coinminer_elex_floxif_glassworm_luca-stealer_njra.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-24_e8ac71d4ca08c521be27de24e2e3b17d_amadey_coinminer_elex_floxif_glassworm_luca-stealer_njra.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:4772
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 524
  2⤵
  - Program crash
  PID:1808
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 564
  2⤵
  - Program crash
  PID:3116
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 544
  2⤵
  - Program crash
  PID:2088
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 524
  2⤵
  - Program crash
  PID:4492
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 532
  2⤵
  - Program crash
  PID:1728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4772 -ip 4772
1⤵
PID:1708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4772 -ip 4772
1⤵
PID:2852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4772 -ip 4772
1⤵
PID:524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4772 -ip 4772
1⤵
PID:2136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4772 -ip 4772
1⤵
PID:3280

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

symsrv.dll

Path C:\Program Files\Common Files\System\symsrv.dll
Size 67KB
SHA256 de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
MD5 7574cf2c64f35161ab1292e2f532aabf
SHA1 14ba3fa927a06224dfe587014299e834def4644f
SHA512 4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab
SSDEEP 1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7ZL:c8y93KQjy7G55riF1cMo03V
TLSH
T17863F1372AB5807DDD210D37949F835AB771E5A76C20643FC25907D988B8DD0E3239AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4772-3-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/4772-4-0x00000000004A5000-0x00000000004A6000-memory.dmp

Download

memory/4772-8-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/4772-6-0x0000000000460000-0x00000000007B8000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads