floxif | 9a41a29e59306910d30f0dedbeaf92d4b73a84e9ea81df72b017f8dfc612291c

General

Target
2026-11-06_d154bc35642afd49882f19ff5c9b8a03_darkgate_elex_floxif_smoke-loader
Size 2.0MB
Sample261107-2latqsgt5j
SHA256 9a41a29e59306910d30f0dedbeaf92d4b73a84e9ea81df72b017f8dfc612291c
MD5 d154bc35642afd49882f19ff5c9b8a03
SHA1 53b3aa8853c79639e5b977666982232a8c452988
SHA512 676754e80514670c9f61b07ff7d9912052f664bb340a4d64e85d4fedd8e4cb9e7afa33b0a1e60ade49452945b276f00dafd6e05f0da816ebca3f4f60681ce5a0
SSDEEP 49152:jio6pWgAw3u+ZDYolW9Y3OqkWXNc3lfF9LLPOhtBZ8rIy1cgD5jHmH:jApWIuOTW9Y3OqkWXNc3lfFutH8rIy10
TLSH
T191A59F323690D0BBC1733631A54EA3B9B2A9AD704D75428B13953F3D6E70493992C7AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-11-06_d154bc35642afd49882f19ff5c9b8a03_darkgate_elex_floxif_smoke-loader
- Size 2.0MB
- SHA256 9a41a29e59306910d30f0dedbeaf92d4b73a84e9ea81df72b017f8dfc612291c
- MD5 d154bc35642afd49882f19ff5c9b8a03
- SHA1 53b3aa8853c79639e5b977666982232a8c452988
- SHA512 676754e80514670c9f61b07ff7d9912052f664bb340a4d64e85d4fedd8e4cb9e7afa33b0a1e60ade49452945b276f00dafd6e05f0da816ebca3f4f60681ce5a0
- SSDEEP 49152:jio6pWgAw3u+ZDYolW9Y3OqkWXNc3lfF9LLPOhtBZ8rIy1cgD5jHmH:jApWIuOTW9Y3OqkWXNc3lfFutH8rIy10
- TLSH
  T191A59F323690D0BBC1733631A54EA3B9B2A9AD704D75428B13953F3D6E70493992C7AF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor discovery floxif persistence privilege_escalation trojan upx
- Family: Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Detects Floxif payload
  backdoor
- Custom signature
  
  UPX dump on OEP (original entry point)
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2