floxif | 8642919e45f712307557426ec4469faafb3755606e00df7c548a5dd93837400b

General

Target
2026-10-02_c0ea75ebda9a27c5bb0358cd6d370989_amadey_elex_floxif_rhadamanthys_smoke-loader
Size 41.1MB
Sample261003-egw5va1zhy
SHA256 8642919e45f712307557426ec4469faafb3755606e00df7c548a5dd93837400b
MD5 c0ea75ebda9a27c5bb0358cd6d370989
SHA1 de1357058d782469b9c63c4d674fbaa993d38864
SHA512 e8cd5e2710e53624c15de40b76b52ea36e8217f42cfaf950f846df2efbcffb13987d0b5c73933c395b5942c5315214f3373bb454cd456c53321d0052f8fb2998
SSDEEP 786432:T20rtPwxD5pJfxAHKJ6ETbpu3bxmdAMsbRAn8RthR6T:5rtP4TAHaTEbxmdApA88
TLSH
T1179733146390D7BCD05BE9F4149E603D3BF9FC8663649F8BEB680A5E61DE3C258205CA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-10-02_c0ea75ebda9a27c5bb0358cd6d370989_amadey_elex_floxif_rhadamanthys_smoke-loader
- Size 41.1MB
- SHA256 8642919e45f712307557426ec4469faafb3755606e00df7c548a5dd93837400b
- MD5 c0ea75ebda9a27c5bb0358cd6d370989
- SHA1 de1357058d782469b9c63c4d674fbaa993d38864
- SHA512 e8cd5e2710e53624c15de40b76b52ea36e8217f42cfaf950f846df2efbcffb13987d0b5c73933c395b5942c5315214f3373bb454cd456c53321d0052f8fb2998
- SSDEEP 786432:T20rtPwxD5pJfxAHKJ6ETbpu3bxmdAMsbRAn8RthR6T:5rtP4TAHaTEbxmdApA88
- TLSH
  T1179733146390D7BCD05BE9F4149E603D3BF9FC8663649F8BEB680A5E61DE3C258205CA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor discovery floxif trojan upx persistence privilege_escalation
- Family: Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Detects Floxif payload
  backdoor
- UPX dump on OEP (original entry point)
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2