floxif | fbf56e7722de294b2d1d551376eadf1a9420becbf08cbf977bb27cc151b629c9

General

Target
2026-09-28_b5291e6bd59d031e099bdddf2a4c9d26_coinminer_darkgate_elex_floxif_graphican_mafia_remcos
Size 2.0MB
Sample260929-c2187azz7r
SHA256 fbf56e7722de294b2d1d551376eadf1a9420becbf08cbf977bb27cc151b629c9
MD5 b5291e6bd59d031e099bdddf2a4c9d26
SHA1 53e84e3b554d9211b25d884bcd3d64954a1285c7
SHA512 63439c5b8a880fdbda6cbc4dccd5aed9dec7137d11d1aae4a02a48acfc0ebe5367781fbd1951a5256dbae7867ab444e382e765cfed097abad56cf1b74738d02b
SSDEEP 49152:v1LGMMeYvW26uIwXDPLD4TQ+kjCG6n5gtyvkBT/Wz4HT38aNLQmcZru5IciI:v1LGMMeYvIu5DPLD4TQ+kj65g0vkBT/t
TLSH
T189959E21F6A0C477C5723131E5DDA3BDA7F8EB300B79128766902E3D2E744D25A3866B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-09-28_b5291e6bd59d031e099bdddf2a4c9d26_coinminer_darkgate_elex_floxif_graphican_mafia_remcos
- Size 2.0MB
- SHA256 fbf56e7722de294b2d1d551376eadf1a9420becbf08cbf977bb27cc151b629c9
- MD5 b5291e6bd59d031e099bdddf2a4c9d26
- SHA1 53e84e3b554d9211b25d884bcd3d64954a1285c7
- SHA512 63439c5b8a880fdbda6cbc4dccd5aed9dec7137d11d1aae4a02a48acfc0ebe5367781fbd1951a5256dbae7867ab444e382e765cfed097abad56cf1b74738d02b
- SSDEEP 49152:v1LGMMeYvW26uIwXDPLD4TQ+kjCG6n5gtyvkBT/Wz4HT38aNLQmcZru5IciI:v1LGMMeYvIu5DPLD4TQ+kj65g0vkBT/t
- TLSH
  T189959E21F6A0C477C5723131E5DDA3BDA7F8EB300B79128766902E3D2E744D25A3866B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor discovery floxif persistence privilege_escalation trojan upx
- Family: Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Detects Floxif payload
  backdoor
- UPX dump on OEP (original entry point)
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2