floxif | bf1d5ed7af5205953b9c2ff43ae99d68c2d576cb816fbf531769cd39c0e3ecf0

General

Target
2026-10-13_40886ec442a27553c6adfa769d54af79_darkgate_elex_floxif_hijackloader_mafia_magniber
Size 3.3MB
Sample261015-smrdfast9p
SHA256 bf1d5ed7af5205953b9c2ff43ae99d68c2d576cb816fbf531769cd39c0e3ecf0
MD5 40886ec442a27553c6adfa769d54af79
SHA1 7801d9f744e29ac46f385c44cfc72bf98f26f20b
SHA512 dd337bca07cf32eaefe82992546d23407c9580e2b20c5841bfbf4142f50218cb5416836e472c469bdfcc854844ba0d38c6fbfa50f1291289432d627d669b8081
SSDEEP 98304:ShQ8XM/Jn4Y32vFEVbAWGHZ5MrLqP2EoBF4oj9ghi1RebMIg9Cbk/V8TCgKcCa1H:StypVYZ5OqP2EoBF4ojDIg9Cbk/V8Fhx
TLSH
T158F5B0217FBD4079D4A33131899DAB7CE66ABD746B3502B712503E3ABF317824D2861B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-10-13_40886ec442a27553c6adfa769d54af79_darkgate_elex_floxif_hijackloader_mafia_magniber
- Size 3.3MB
- SHA256 bf1d5ed7af5205953b9c2ff43ae99d68c2d576cb816fbf531769cd39c0e3ecf0
- MD5 40886ec442a27553c6adfa769d54af79
- SHA1 7801d9f744e29ac46f385c44cfc72bf98f26f20b
- SHA512 dd337bca07cf32eaefe82992546d23407c9580e2b20c5841bfbf4142f50218cb5416836e472c469bdfcc854844ba0d38c6fbfa50f1291289432d627d669b8081
- SSDEEP 98304:ShQ8XM/Jn4Y32vFEVbAWGHZ5MrLqP2EoBF4oj9ghi1RebMIg9Cbk/V8TCgKcCa1H:StypVYZ5OqP2EoBF4ojDIg9Cbk/V8Fhx
- TLSH
  T158F5B0217FBD4079D4A33131899DAB7CE66ABD746B3502B712503E3ABF317824D2861B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor discovery floxif trojan upx persistence privilege_escalation
- Family: Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Detects Floxif payload
  backdoor
- UPX dump on OEP (original entry point)
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2