floxif | 27795952357dcd12be894d7339499b489420ee518a9e1a08167c6206f6f91c2b

General

Target
2026-10-22_363868b269022123b8ce0753826900ac_elex_floxif_stop
Size 49.6MB
Sample261024-vbterscy3l
SHA256 27795952357dcd12be894d7339499b489420ee518a9e1a08167c6206f6f91c2b
MD5 363868b269022123b8ce0753826900ac
SHA1 6af1cc69a8a396db91623103502e7284639946e7
SHA512 a7d820a9a4100b0192247f4f362e1c18ed8d4a33f9499a1e09587b436c38180fb210276c1b2d1a5becd1749ea76f6a5e1f89dda206a62f6de88ee034c4d16ed9
SSDEEP 786432:gy9/2T238Sy5hw2wbIi4wwOHBjzX+vl7pPO0BK8BDuYA7m/ivLkR9nT1eU3+8DpT:gyITaynkIz6BjzXkPO0fiwxTfrDTyKX
TLSH
T1F7B733F5EC8546D4FF9295FD10059A88F258BCED6A602E05DB0077CFE93F86682E4AC1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-10-22_363868b269022123b8ce0753826900ac_elex_floxif_stop
- Size 49.6MB
- SHA256 27795952357dcd12be894d7339499b489420ee518a9e1a08167c6206f6f91c2b
- MD5 363868b269022123b8ce0753826900ac
- SHA1 6af1cc69a8a396db91623103502e7284639946e7
- SHA512 a7d820a9a4100b0192247f4f362e1c18ed8d4a33f9499a1e09587b436c38180fb210276c1b2d1a5becd1749ea76f6a5e1f89dda206a62f6de88ee034c4d16ed9
- SSDEEP 786432:gy9/2T238Sy5hw2wbIi4wwOHBjzX+vl7pPO0BK8BDuYA7m/ivLkR9nT1eU3+8DpT:gyITaynkIz6BjzXkPO0fiwxTfrDTyKX
- TLSH
  T1F7B733F5EC8546D4FF9295FD10059A88F258BCED6A602E05DB0077CFE93F86682E4AC1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor cryptone defense_evasion discovery floxif packer persistence privilege_escalation ransomware spyware trojan upx
- Family: Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- CryptOne packer
  Detects CryptOne packer defined in NCC blogpost.
  cryptone packer
- Detects Floxif payload
  backdoor
- UPX dump on OEP (original entry point)
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Executes dropped EXE
- Loads dropped DLL
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2