floxif | 60e3973f21f87f9ac86497d86c634068a2f6bc431e0afdfeb7159f5bb5c63051

General

Target
2026-10-07_70b618188407440234c9381c8031d367_coinminer_darkgate_elex_floxif_rhadamanthys_stop
Size 2.6MB
Sample261008-m7zyesfv4p
SHA256 60e3973f21f87f9ac86497d86c634068a2f6bc431e0afdfeb7159f5bb5c63051
MD5 70b618188407440234c9381c8031d367
SHA1 6207b9562914730d8bdc45446b1b68adb41010eb
SHA512 3083395710ed0a0fe839801f34d30c9cd149ccb2351b09d3275e667cf6356323b4c1cb9c442ba0f3ec98151b23ad0164e852c80ef5900d67c0cfbd0b0f2f5927
SSDEEP 49152:eZe2v4PXUh2keMEe+OlWdfWg1xMYjKIw3r0rVYlZtMw3ZKTvoPqrrMMDMMM66MIK:KvAUZqe+OdqMYjKIuri2ZttsLoPqrrMS
TLSH
T190C59E313BD1C136C27231319D6BA37AB2AAAD315B3146C726802E3D6D745D3A93D72B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-10-07_70b618188407440234c9381c8031d367_coinminer_darkgate_elex_floxif_rhadamanthys_stop
- Size 2.6MB
- SHA256 60e3973f21f87f9ac86497d86c634068a2f6bc431e0afdfeb7159f5bb5c63051
- MD5 70b618188407440234c9381c8031d367
- SHA1 6207b9562914730d8bdc45446b1b68adb41010eb
- SHA512 3083395710ed0a0fe839801f34d30c9cd149ccb2351b09d3275e667cf6356323b4c1cb9c442ba0f3ec98151b23ad0164e852c80ef5900d67c0cfbd0b0f2f5927
- SSDEEP 49152:eZe2v4PXUh2keMEe+OlWdfWg1xMYjKIw3r0rVYlZtMw3ZKTvoPqrrMMDMMM66MIK:KvAUZqe+OdqMYjKIuri2ZttsLoPqrrMS
- TLSH
  T190C59E313BD1C136C27231319D6BA37AB2AAAD315B3146C726802E3D6D745D3A93D72B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor discovery floxif persistence privilege_escalation trojan upx
- Family: Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Detects Floxif payload
  backdoor
- UPX dump on OEP (original entry point)
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2