floxif | 984fb95cf3259415236913589eec12cc6ce77b816f34100a46d2a286443a76b8

General

Target
2026-10-22_3a95cc93fb5f56daa7e03892cd3cab9f_amadey_elex_floxif_smoke-loader_stealc_stop
Size 1.9MB
Sample261024-tpd2kafc52
SHA256 984fb95cf3259415236913589eec12cc6ce77b816f34100a46d2a286443a76b8
MD5 3a95cc93fb5f56daa7e03892cd3cab9f
SHA1 1a1fe8652edd04bff4fb049c67b4c423c4e0f8a0
SHA512 4dd9ce0fc568e1f31648d4b38257565b48ecb6bbb9db190e21b3c5fc4a1edeb82041801e2d72e0a9313834ef14c478d8ba1690f7994eebe8d6885430a3066a91
SSDEEP 49152:aiJNayjLc6pIVvblIgy93ZYqMc/8AoZCLR1:ainLc6pIbOgOJplx/
TLSH
T12395232132D0C3F9E4624D387E6C9614B9F5BD3C4B77828AB7403A296D3D527CA1A71B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-10-22_3a95cc93fb5f56daa7e03892cd3cab9f_amadey_elex_floxif_smoke-loader_stealc_stop
- Size 1.9MB
- SHA256 984fb95cf3259415236913589eec12cc6ce77b816f34100a46d2a286443a76b8
- MD5 3a95cc93fb5f56daa7e03892cd3cab9f
- SHA1 1a1fe8652edd04bff4fb049c67b4c423c4e0f8a0
- SHA512 4dd9ce0fc568e1f31648d4b38257565b48ecb6bbb9db190e21b3c5fc4a1edeb82041801e2d72e0a9313834ef14c478d8ba1690f7994eebe8d6885430a3066a91
- SSDEEP 49152:aiJNayjLc6pIVvblIgy93ZYqMc/8AoZCLR1:ainLc6pIbOgOJplx/
- TLSH
  T12395232132D0C3F9E4624D387E6C9614B9F5BD3C4B77828AB7403A296D3D527CA1A71B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor bootkit discovery floxif persistence trojan upx
- Family: Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Detects Floxif payload
  backdoor
- UPX dump on OEP (original entry point)
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2