floxif | 097660bc244829805110ba094404ae3610db4f07c6ecaeafffa212d78524b424

General

Target
2026-10-21_d1822f57107d10c822f968e25d3c200e_darkgate_elex_emotet_floxif_remcos_rhadamanthys_stop
Size 14.7MB
Sample261022-jreqrsy1fv
SHA256 097660bc244829805110ba094404ae3610db4f07c6ecaeafffa212d78524b424
MD5 d1822f57107d10c822f968e25d3c200e
SHA1 4604abf7bea5efda603ca0de06fb1a39bc1d0b5a
SHA512 4cd8981e7ee86f5d6794d1c832143fd77a35d41e002f8004288e240349ab80f4818169c57d43831751072561f0f77f3016e73ae31900e3fe88bf3a7e0a2d8a4f
SSDEEP 98304:AgNMQSi9PdrulYKttCoWDdgjfowAoj9ghi1RebM390bYV2+SHHgSHHDJdMM+:AgVeWeEojD390bYV2+SHHgSHHDXT+
TLSH
T1FDF63F5B76E631B3E3A9C0B8E612E61499CF4CE683ED7E8D81583365D1B17858D2033E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-10-21_d1822f57107d10c822f968e25d3c200e_darkgate_elex_emotet_floxif_remcos_rhadamanthys_stop
- Size 14.7MB
- SHA256 097660bc244829805110ba094404ae3610db4f07c6ecaeafffa212d78524b424
- MD5 d1822f57107d10c822f968e25d3c200e
- SHA1 4604abf7bea5efda603ca0de06fb1a39bc1d0b5a
- SHA512 4cd8981e7ee86f5d6794d1c832143fd77a35d41e002f8004288e240349ab80f4818169c57d43831751072561f0f77f3016e73ae31900e3fe88bf3a7e0a2d8a4f
- SSDEEP 98304:AgNMQSi9PdrulYKttCoWDdgjfowAoj9ghi1RebM390bYV2+SHHgSHHDJdMM+:AgVeWeEojD390bYV2+SHHgSHHDXT+
- TLSH
  T1FDF63F5B76E631B3E3A9C0B8E612E61499CF4CE683ED7E8D81583365D1B17858D2033E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor discovery floxif persistence privilege_escalation trojan upx
- Family: Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Detects Floxif payload
  backdoor
- UPX dump on OEP (original entry point)
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2