floxif | 95d33b9ed40adc0e09af9f9832c027392655c187d639a4ccd6ad681cf7e590f5

General

Target
2026-09-29_1d4b3a151859ca43dd2ca160164820fd_elex_floxif_stop
Size 718KB
Sample260930-3c9gdavvcy
SHA256 95d33b9ed40adc0e09af9f9832c027392655c187d639a4ccd6ad681cf7e590f5
MD5 1d4b3a151859ca43dd2ca160164820fd
SHA1 abe30723f1966af31222b75e0625547e7fe27405
SHA512 9dd645f18ba9fbc0e8ef6d13bbee938b2615cf518396f66983a801b983141c6f8fa4ab0020a80d22d0d5f3d1d6330ccf0fee271a920821acbd36ab5b8aa966ac
SSDEEP 12288:uH7Wcjdcrr2sxxiPGGAOOPSXDVSGgVYhX5FSV89iE1KBjvrEH7pw:ubCv2sObHXqQA89ifrEH7i
TLSH
T1A7F4BF12B3C741F9DD923974257AE32B9B35762C132BC9C7EFE12D628E201419B39366
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-09-29_1d4b3a151859ca43dd2ca160164820fd_elex_floxif_stop
- Size 718KB
- SHA256 95d33b9ed40adc0e09af9f9832c027392655c187d639a4ccd6ad681cf7e590f5
- MD5 1d4b3a151859ca43dd2ca160164820fd
- SHA1 abe30723f1966af31222b75e0625547e7fe27405
- SHA512 9dd645f18ba9fbc0e8ef6d13bbee938b2615cf518396f66983a801b983141c6f8fa4ab0020a80d22d0d5f3d1d6330ccf0fee271a920821acbd36ab5b8aa966ac
- SSDEEP 12288:uH7Wcjdcrr2sxxiPGGAOOPSXDVSGgVYhX5FSV89iE1KBjvrEH7pw:ubCv2sObHXqQA89ifrEH7i
- TLSH
  T1A7F4BF12B3C741F9DD923974257AE32B9B35762C132BC9C7EFE12D628E201419B39366
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor discovery execution floxif persistence privilege_escalation trojan upx
- Family: Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Detects Floxif payload
  backdoor
- UPX dump on OEP (original entry point)
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2