floxif | 6fa7ac4b2198d2866e3bd8cf7ef1cf2ab7fa8db7a6f0842c2816911cb9cd38ac

General

Target
2026-10-04_b4216df38de0684c99958f1c261830fc_amadey_elex_floxif_rhadamanthys_smoke-loader
Size 41.1MB
Sample261005-fyhjfstfpf
SHA256 6fa7ac4b2198d2866e3bd8cf7ef1cf2ab7fa8db7a6f0842c2816911cb9cd38ac
MD5 b4216df38de0684c99958f1c261830fc
SHA1 b64a0a6d90185e7b384b30f8738f914ddf586476
SHA512 7c96138b6fe52e44e011a892068086ccae9847c675676c00e87c29db959456e22fa829679259690fdd6faf76e1bd02ce174b2cbdf29b53b4f5f920c097bfc5d9
SSDEEP 786432:d20rtPwxD5pJfxAHKJ6ETbpu3bxmdAMsbRAn8RthR69:7rtP4TAHaTEbxmdApA8q
TLSH
T1069733146390D7BCD05BE9F4109E603D3BF9FC8663649F9BEB680A5E61DE3C258205CA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-10-04_b4216df38de0684c99958f1c261830fc_amadey_elex_floxif_rhadamanthys_smoke-loader
- Size 41.1MB
- SHA256 6fa7ac4b2198d2866e3bd8cf7ef1cf2ab7fa8db7a6f0842c2816911cb9cd38ac
- MD5 b4216df38de0684c99958f1c261830fc
- SHA1 b64a0a6d90185e7b384b30f8738f914ddf586476
- SHA512 7c96138b6fe52e44e011a892068086ccae9847c675676c00e87c29db959456e22fa829679259690fdd6faf76e1bd02ce174b2cbdf29b53b4f5f920c097bfc5d9
- SSDEEP 786432:d20rtPwxD5pJfxAHKJ6ETbpu3bxmdAMsbRAn8RthR69:7rtP4TAHaTEbxmdApA8q
- TLSH
  T1069733146390D7BCD05BE9F4109E603D3BF9FC8663649F9BEB680A5E61DE3C258205CA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor discovery floxif trojan upx persistence privilege_escalation
- Family: Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Detects Floxif payload
  backdoor
- UPX dump on OEP (original entry point)
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2