Extracted

• • Target
    2026-09-27_dbfbf7656b911b83d8a8c5e23ac77cc5_amadey_dark-comet_darkgate_elex_floxif_gcleaner_glassworm_hawkeye_remcos_smoke-loader
  • Size 13.4MB
  • SHA256 c3c04460c05d3368e18d1c31d7ce053dcea3d08fc4b2526fbab4df4c500a43f0
  • MD5 dbfbf7656b911b83d8a8c5e23ac77cc5
  • SHA1 11713d89f1c882195ce0a075a1d39c64179798d8
  • SHA512 51acd9031f040d5f1f17b143d3f6e5b16c6f4521e3157cc27d23b0037afcf42bd951e80f5fa2cfa978632c1aef6ab19a224f8b0c975e750aad4d34480ac5ead4
  • SSDEEP 196608:CL8jpRVd20orj1kDIboDvEtuW9XzuaAdxEdqbLDGn7xK0sWsP9SN0ED:CszmjuDJDvk6xdxEkben7sw1D
  • TLSH
    T1C4E6223071919236FDB206359D7E8271C8297EA12B3465CBF3F4394D9AFAD81692036F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordiscoveryfloxifxredpersistenceprivilege_escalationtrojanupxdefense_evasionexecution

  • Family: Floxif, Floodfix

    Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.

    backdoortrojanfloxif

  • Family: Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Detects Floxif payload

    backdoor

  • UPX dump on OEP (original entry point)

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • ACProtect 1.3x - 1.4x DLL software

    Detects file using ACProtect software.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2