floxif | 4279387112a40173e875186bdc5abad569e6647f7f4a954296ecea2d9d22f7cd

General

Target
2026-10-19_248881997f8d90df153e7fcac75083aa_amadey_cobalt-strike_elex_floxif_glassworm_icedid_luca-stealer_magicrat_njrat_remcos_swisyn_vidar
Size 26.5MB
Sample261021-bsp9wsbz2q
SHA256 4279387112a40173e875186bdc5abad569e6647f7f4a954296ecea2d9d22f7cd
MD5 248881997f8d90df153e7fcac75083aa
SHA1 95c991ef88538f0a3b4f48c2dd834b3670dd51a9
SHA512 a5346125df1ef46ec26b448abf4daeb0b082966b74df42ed473bd27da2e20b56c73547a23c008b8fe0f8b582a870aea175d3177cfa379ea6b1b6669785111412
SSDEEP 393216:JAhURnVHF77LMAcXaX0Xpb9cpxFDdbkqH885dPIc/Jsv6tWKFdu9C1ZLh:2uVl7cXaXSb9CFZbkJ85dwcV
TLSH
T1DB579E0DFB8754F4DB2305B1864BF77B463026258422EDEBEF8DEE8DA8371612416726
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-10-19_248881997f8d90df153e7fcac75083aa_amadey_cobalt-strike_elex_floxif_glassworm_icedid_luca-stealer_magicrat_njrat_remcos_swisyn_vidar
- Size 26.5MB
- SHA256 4279387112a40173e875186bdc5abad569e6647f7f4a954296ecea2d9d22f7cd
- MD5 248881997f8d90df153e7fcac75083aa
- SHA1 95c991ef88538f0a3b4f48c2dd834b3670dd51a9
- SHA512 a5346125df1ef46ec26b448abf4daeb0b082966b74df42ed473bd27da2e20b56c73547a23c008b8fe0f8b582a870aea175d3177cfa379ea6b1b6669785111412
- SSDEEP 393216:JAhURnVHF77LMAcXaX0Xpb9cpxFDdbkqH885dPIc/Jsv6tWKFdu9C1ZLh:2uVl7cXaXSb9CFZbkJ85dwcV
- TLSH
  T1DB579E0DFB8754F4DB2305B1864BF77B463026258422EDEBEF8DEE8DA8371612416726
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor defense_evasion discovery floxif persistence trojan upx privilege_escalation
- Family: Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Modifies visibility of hidden/system files in Explorer
  defense_evasion
- Detects Floxif payload
  backdoor
- UPX dump on OEP (original entry point)
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2