floxif | 3f2f7685ecd42094db4152dfa0402f5e788910a7c63997f5802eca793f23e43c

General

Target
2026-10-22_4c58805cf5b692f17e20d7eb0d923680_driverpack_elex_floxif_wannacry
Size 27.6MB
Sample261024-q9c38afa88
SHA256 3f2f7685ecd42094db4152dfa0402f5e788910a7c63997f5802eca793f23e43c
MD5 4c58805cf5b692f17e20d7eb0d923680
SHA1 87ec1e80f8e65a633976b3440f9e6a5e55a1bc11
SHA512 d86f8bb2863ebad3c09a41e01cee09485a5d9f7cb97452ede4d8f1d2ed36b78a8ac9d286d6360060dc771a42f42d67864d92c761742720558167ef73e3836b69
SSDEEP 786432:uVWNqlmJy3Ep5IFxJJzKC30Gz6HLK63ZMxoPTAe:uVwy3EPQEGz6rKcZMmPTAe
TLSH
T18157338CA1F343FAC3425D33444A5C8A8491F62E0926B4C657771EE37E7A7B9A1BB0D1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-10-22_4c58805cf5b692f17e20d7eb0d923680_driverpack_elex_floxif_wannacry
- Size 27.6MB
- SHA256 3f2f7685ecd42094db4152dfa0402f5e788910a7c63997f5802eca793f23e43c
- MD5 4c58805cf5b692f17e20d7eb0d923680
- SHA1 87ec1e80f8e65a633976b3440f9e6a5e55a1bc11
- SHA512 d86f8bb2863ebad3c09a41e01cee09485a5d9f7cb97452ede4d8f1d2ed36b78a8ac9d286d6360060dc771a42f42d67864d92c761742720558167ef73e3836b69
- SSDEEP 786432:uVWNqlmJy3Ep5IFxJJzKC30Gz6HLK63ZMxoPTAe:uVwy3EPQEGz6rKcZMmPTAe
- TLSH
  T18157338CA1F343FAC3425D33444A5C8A8491F62E0926B4C657771EE37E7A7B9A1BB0D1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor discovery execution floxif persistence trojan upx
- Family: Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Detects Floxif payload
  backdoor
- UPX dump on OEP (original entry point)
- Drops file in Drivers directory
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates new service(s)
  persistence execution
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2