floxif | d78e79fccdf16ee0797749a7a425db503d4da669b3ca01da4a038c1ba71b93c8

General

Target
2026-10-19_be64d9602be78d44a1e1bef6023623b0_elex_floxif_hacktools_wannacry
Size 860KB
Sample261020-maa8ssgs7s
SHA256 d78e79fccdf16ee0797749a7a425db503d4da669b3ca01da4a038c1ba71b93c8
MD5 be64d9602be78d44a1e1bef6023623b0
SHA1 c8942c7c1d5f1d988662728c1d98d4ff602f5940
SHA512 dd60d5c24901ab170594a23f2aaf935910b6a4af63a814861de9d05bdf58932b15838ad6e7ba37aececb9f4c85c8bcaae93707c025a39bec34fe9a81957d2afc
SSDEEP 24576:FGFJwK/f/npt3X8je6GrHtzRtO7GymDoFw4mrEH7n:FGTwm/z8jefy44w4
TLSH
T1D015BE133D8182BFC1710531E98A2BB6F5F7EEA80D794D435384BE2C6A7AD01DE17629
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-10-19_be64d9602be78d44a1e1bef6023623b0_elex_floxif_hacktools_wannacry
- Size 860KB
- SHA256 d78e79fccdf16ee0797749a7a425db503d4da669b3ca01da4a038c1ba71b93c8
- MD5 be64d9602be78d44a1e1bef6023623b0
- SHA1 c8942c7c1d5f1d988662728c1d98d4ff602f5940
- SHA512 dd60d5c24901ab170594a23f2aaf935910b6a4af63a814861de9d05bdf58932b15838ad6e7ba37aececb9f4c85c8bcaae93707c025a39bec34fe9a81957d2afc
- SSDEEP 24576:FGFJwK/f/npt3X8je6GrHtzRtO7GymDoFw4mrEH7n:FGTwm/z8jefy44w4
- TLSH
  T1D015BE133D8182BFC1710531E98A2BB6F5F7EEA80D794D435384BE2C6A7AD01DE17629
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor bootkit defense_evasion discovery floxif persistence privilege_escalation trojan upx
- Family: Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Detects Floxif payload
  backdoor
- Custom signature
  
  UPX dump on OEP (original entry point)
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2