floxif | 1219284272cbe60c25d17011993b1dfc9b79731bd125ab016ebbf60784e778d3

General

Target
2026-10-09_4d34c409ee9f0ce17b3fc14429577745_coinminer_driverpack_elex_floxif_wannacry
Size 1.5MB
Sample261010-qsjvfahf49
SHA256 1219284272cbe60c25d17011993b1dfc9b79731bd125ab016ebbf60784e778d3
MD5 4d34c409ee9f0ce17b3fc14429577745
SHA1 3a82e35825ffa991dd6bb7eebdb34f3431de3fbf
SHA512 b56e58dd7ed4de3ca9ffa50b99b1869f1c869a5fd206abea41988cf9793ba0c90f6ab2385a440a22c85dc31c4db00ff6e5d33d32484ca29115cfa7f2a5ce31fd
SSDEEP 24576:b53JFUdRkGTgv6UYt+3h6dTM5F++SoDeZg88r5s6QdhiQyDHkhp+gz7VdPpeV3F0:b5ZFgaP6jYh6dg5DSo5VrilhiQywhp+m
TLSH
T1E16512413A9983F9C8520030FC49EBB266E5AEBD171625E7A3E23F17BC7D6C4867D016
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-10-09_4d34c409ee9f0ce17b3fc14429577745_coinminer_driverpack_elex_floxif_wannacry
- Size 1.5MB
- SHA256 1219284272cbe60c25d17011993b1dfc9b79731bd125ab016ebbf60784e778d3
- MD5 4d34c409ee9f0ce17b3fc14429577745
- SHA1 3a82e35825ffa991dd6bb7eebdb34f3431de3fbf
- SHA512 b56e58dd7ed4de3ca9ffa50b99b1869f1c869a5fd206abea41988cf9793ba0c90f6ab2385a440a22c85dc31c4db00ff6e5d33d32484ca29115cfa7f2a5ce31fd
- SSDEEP 24576:b53JFUdRkGTgv6UYt+3h6dTM5F++SoDeZg88r5s6QdhiQyDHkhp+gz7VdPpeV3F0:b5ZFgaP6jYh6dg5DSo5VrilhiQywhp+m
- TLSH
  T1E16512413A9983F9C8520030FC49EBB266E5AEBD171625E7A3E23F17BC7D6C4867D016
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor defense_evasion discovery floxif persistence privilege_escalation trojan upx
- Family: Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Detects Floxif payload
  backdoor
- UPX dump on OEP (original entry point)
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
  defense_evasion trojan
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2