floxif | 3524486608146d23d3a42fa4d31ac8fe032e26c3ac35c5204e6907c0a3bbc1f7

General

Target
2026-10-11_4284b8d8db775edc4aa434c2ca9948cd_elex_emotet_floxif_icedid_remcos
Size 3.4MB
Sample261012-3bntaayw5k
SHA256 3524486608146d23d3a42fa4d31ac8fe032e26c3ac35c5204e6907c0a3bbc1f7
MD5 4284b8d8db775edc4aa434c2ca9948cd
SHA1 c37cfdcfe33f3b962b36d65eefa16aa14f5534b8
SHA512 f6a60625fafd4b69b1306f4cdefa093b067072dacb42a22da8f68fb0a3089cd8d61ef2bff76dd0432c50c830ce14d82e3f1bcdb329b08141557dc5047136ab7e
SSDEEP 98304:xUcmFqiWT/dd+iKcJltrtCW9PO5scR+hu4:xBmF4T/X5Fp
TLSH
T1B8F57B12BF8D807AC65915309B6A7F765274AC453B24A3CB7231FE3DEC323D2657620A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-10-11_4284b8d8db775edc4aa434c2ca9948cd_elex_emotet_floxif_icedid_remcos
- Size 3.4MB
- SHA256 3524486608146d23d3a42fa4d31ac8fe032e26c3ac35c5204e6907c0a3bbc1f7
- MD5 4284b8d8db775edc4aa434c2ca9948cd
- SHA1 c37cfdcfe33f3b962b36d65eefa16aa14f5534b8
- SHA512 f6a60625fafd4b69b1306f4cdefa093b067072dacb42a22da8f68fb0a3089cd8d61ef2bff76dd0432c50c830ce14d82e3f1bcdb329b08141557dc5047136ab7e
- SSDEEP 98304:xUcmFqiWT/dd+iKcJltrtCW9PO5scR+hu4:xBmF4T/X5Fp
- TLSH
  T1B8F57B12BF8D807AC65915309B6A7F765274AC453B24A3CB7231FE3DEC323D2657620A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

adware backdoor defense_evasion discovery floxif persistence spyware stealer trojan upx privilege_escalation
- Family: Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Detects Floxif payload
  backdoor
- UPX dump on OEP (original entry point)
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  defense_evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2