floxif | affe5910995745971601123c41a3c441c43c8240a2d666f01f4a5fd8b77f8d4c

General

Target
2026-09-30_ff7f7a7a00cf92d7fbf26fb9c1fa3b30_agent-tesla_darkgate_elex_floxif_hawkeye_maze_nanocore-rat_remcos
Size 1.7MB
Sample261001-bglsbssdmf
SHA256 affe5910995745971601123c41a3c441c43c8240a2d666f01f4a5fd8b77f8d4c
MD5 ff7f7a7a00cf92d7fbf26fb9c1fa3b30
SHA1 7dce232758ef7950a895c68319f6e0764a3bacff
SHA512 7a5d86f07e4cd09f577ead6d396d6d859e9dedc61133ad8c442e01d7483bb3c50cd8fbe694f73383c08c7c26c6ef41a375196086fd0c19704b9b140fccb8fb5a
SSDEEP 24576:SCdxtCL0jYLT3U1jfsWaj4jmcLlW5W/lLv359XNe+W+sytd49OuzHQFrEH77G:DW0cTsjkWajsmJ5W9L/Hw+htd4dM1
TLSH
T13185E02273DD83A5C7769073BF29B3116EBF7C690630B85B2F880D79B954161262CB63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-09-30_ff7f7a7a00cf92d7fbf26fb9c1fa3b30_agent-tesla_darkgate_elex_floxif_hawkeye_maze_nanocore-rat_remcos
- Size 1.7MB
- SHA256 affe5910995745971601123c41a3c441c43c8240a2d666f01f4a5fd8b77f8d4c
- MD5 ff7f7a7a00cf92d7fbf26fb9c1fa3b30
- SHA1 7dce232758ef7950a895c68319f6e0764a3bacff
- SHA512 7a5d86f07e4cd09f577ead6d396d6d859e9dedc61133ad8c442e01d7483bb3c50cd8fbe694f73383c08c7c26c6ef41a375196086fd0c19704b9b140fccb8fb5a
- SSDEEP 24576:SCdxtCL0jYLT3U1jfsWaj4jmcLlW5W/lLv359XNe+W+sytd49OuzHQFrEH77G:DW0cTsjkWajsmJ5W9L/Hw+htd4dM1
- TLSH
  T13185E02273DD83A5C7769073BF29B3116EBF7C690630B85B2F880D79B954161262CB63
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor discovery floxif persistence privilege_escalation trojan upx
- Family: Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Detects Floxif payload
  backdoor
- UPX dump on OEP (original entry point)
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2