floxif | fbd0c07cc1392c430dd9cb3c4b27ac621c5b1a0ed581e9cc48301589402f5ac9

General

Target
2026-09-26_12d1b38545989599c8f21f91f8d086d3_agent-tesla_backswap_elex_floxif_stop
Size 3.9MB
Sample260927-yc84dsed56
SHA256 fbd0c07cc1392c430dd9cb3c4b27ac621c5b1a0ed581e9cc48301589402f5ac9
MD5 12d1b38545989599c8f21f91f8d086d3
SHA1 7181d201d9a04e6ec6d2daa51223497bd0386e4a
SHA512 e2ab8e0cf798d5edbc8f4b6f778baee9f46e0148f37ba3bab08aebab6ed5118a8615c009754f663775b238a4760d4a2339b47ef12e2a8b9b68532ede34278bb8
SSDEEP 98304:3xvqjis5Q8eZ5EH+bS70RE/rrCVq8FuQ6q4sr:3Bq+L8sS70erT8t548
TLSH
T147162312B7C681F6DE933870392BE367DB35661D0327849BD7E02E729F251419B2B362
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-09-26_12d1b38545989599c8f21f91f8d086d3_agent-tesla_backswap_elex_floxif_stop
- Size 3.9MB
- SHA256 fbd0c07cc1392c430dd9cb3c4b27ac621c5b1a0ed581e9cc48301589402f5ac9
- MD5 12d1b38545989599c8f21f91f8d086d3
- SHA1 7181d201d9a04e6ec6d2daa51223497bd0386e4a
- SHA512 e2ab8e0cf798d5edbc8f4b6f778baee9f46e0148f37ba3bab08aebab6ed5118a8615c009754f663775b238a4760d4a2339b47ef12e2a8b9b68532ede34278bb8
- SSDEEP 98304:3xvqjis5Q8eZ5EH+bS70RE/rrCVq8FuQ6q4sr:3Bq+L8sS70erT8t548
- TLSH
  T147162312B7C681F6DE933870392BE367DB35661D0327849BD7E02E729F251419B2B362
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

adware backdoor discovery floxif persistence privilege_escalation spyware trojan upx
- Family: Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Detects Floxif payload
  backdoor
- UPX dump on OEP (original entry point)
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2