floxif | eae6033ff8cee8e314745a57c5ec984d71c1b97506737d5f496a0a2d1d3922d8

General

Target
2026-10-15_d551e29782ec2311078a0fb1c438c9ab_coinminer_elex_floxif_glassworm_poet-rat_sliver_snatch
Size 17.9MB
Sample261016-d1xp2sfd93
SHA256 eae6033ff8cee8e314745a57c5ec984d71c1b97506737d5f496a0a2d1d3922d8
MD5 d551e29782ec2311078a0fb1c438c9ab
SHA1 e6be6b5f15bcc993550f71dd406ce02793021c38
SHA512 bb9150f89b10ad8daf245c496d432f99f7137071ac04dff100ab78b64d456901188bcd081d6f0ef6c1d4d499c1dfaf1bf270381d228d1008c383c517ae806522
SSDEEP 196608:h+4f/vx9opqeESF+64Nwvjf27jYXg5gG+VbzFZhIZtxTyA6LMDOTbJWB:f5qqeTju3YXg5gV1uvx6LM6IB
TLSH
T135178C50F8EF11FAEF821430A977523F733491059729DEC3C6888D66F8A7AD5172329A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-10-15_d551e29782ec2311078a0fb1c438c9ab_coinminer_elex_floxif_glassworm_poet-rat_sliver_snatch
- Size 17.9MB
- SHA256 eae6033ff8cee8e314745a57c5ec984d71c1b97506737d5f496a0a2d1d3922d8
- MD5 d551e29782ec2311078a0fb1c438c9ab
- SHA1 e6be6b5f15bcc993550f71dd406ce02793021c38
- SHA512 bb9150f89b10ad8daf245c496d432f99f7137071ac04dff100ab78b64d456901188bcd081d6f0ef6c1d4d499c1dfaf1bf270381d228d1008c383c517ae806522
- SSDEEP 196608:h+4f/vx9opqeESF+64Nwvjf27jYXg5gG+VbzFZhIZtxTyA6LMDOTbJWB:f5qqeTju3YXg5gV1uvx6LM6IB
- TLSH
  T135178C50F8EF11FAEF821430A977523F733491059729DEC3C6888D66F8A7AD5172329A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor discovery floxif trojan upx persistence privilege_escalation
- Family: Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Detects Floxif payload
  backdoor
- UPX dump on OEP (original entry point)
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2