floxif | c5caf73fc27cc6bfdfc53718a2120986fcf514e1c15ae59908f2c1aeeb370aa0

General

Target
2026-09-24_6eef45cb544828e23fb457f782f695a1_coinminer_dosia_elex_floxif_frostygoop_glassworm_hive_poet-rat_quasar-rat_salatstealer_sliver_snatch
Size 10.1MB
Sample260925-jdd73ssfpa
SHA256 c5caf73fc27cc6bfdfc53718a2120986fcf514e1c15ae59908f2c1aeeb370aa0
MD5 6eef45cb544828e23fb457f782f695a1
SHA1 84e0a410959dc99e79316f651636980899412ffa
SHA512 87c75280c183afd63731629cf529166c67c9bba6ea40ed7e9c2bc937c975317701763ff8a62537180d3cc4b484cbfef9246520221c65e9eebc1cc845734b4ae5
SSDEEP 98304:b+8Wl5fX5wJ+/Xhg+LPzK7k7bpi6KJOsGAverWEi1:bQlh5nvRPpXE6KJMAvYi1
TLSH
T1B5B63901FECB94F6E903157141ABA36F27306D098B24CBDBEB547B2AF9776D20876205
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-09-24_6eef45cb544828e23fb457f782f695a1_coinminer_dosia_elex_floxif_frostygoop_glassworm_hive_poet-rat_quasar-rat_salatstealer_sliver_snatch
- Size 10.1MB
- SHA256 c5caf73fc27cc6bfdfc53718a2120986fcf514e1c15ae59908f2c1aeeb370aa0
- MD5 6eef45cb544828e23fb457f782f695a1
- SHA1 84e0a410959dc99e79316f651636980899412ffa
- SHA512 87c75280c183afd63731629cf529166c67c9bba6ea40ed7e9c2bc937c975317701763ff8a62537180d3cc4b484cbfef9246520221c65e9eebc1cc845734b4ae5
- SSDEEP 98304:b+8Wl5fX5wJ+/Xhg+LPzK7k7bpi6KJOsGAverWEi1:bQlh5nvRPpXE6KJMAvYi1
- TLSH
  T1B5B63901FECB94F6E903157141ABA36F27306D098B24CBDBEB547B2AF9776D20876205
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor discovery floxif persistence privilege_escalation trojan upx
- Family: Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Detects Floxif payload
  backdoor
- UPX dump on OEP (original entry point)
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2