floxif | 4a7567ef93652c2d29ffa8732c4e471a6d76698197b57bfe9b7bb4e15ddf550d

General

Target
2026-11-06_ec35767b356545d78979cd8f67610c66_amadey_cobalt-strike_elex_floxif_icedid_luca-stealer_njrat_stealc_vidar
Size 6.4MB
Sample261107-ydmxjs1t3k
SHA256 4a7567ef93652c2d29ffa8732c4e471a6d76698197b57bfe9b7bb4e15ddf550d
MD5 ec35767b356545d78979cd8f67610c66
SHA1 ecea64b2a2ea71522a8c82b377f917ae3c18d0fa
SHA512 46e7036d5c1c4f96a8ecf97acf8e0aa1345118aaedf9b531c9fe2fa975cb29592daeb6b532d4a4b759b0434e20c8cdb1c51394e42c52c28b0ca5e6298325c254
SSDEEP 98304:7acgWC6MbNe3tx5H4ZwpLXr33EBqMUBB2Z6YfCuB0iSwgqdN5GAW:KlpIx5H2wpTABGT46YfCuB0bwfN5GAW
TLSH
T1F6669D1576E840E4E4B38130895A9A5FDAB5B9261B3147CF728C5B5F1F336D28E3B322
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-11-06_ec35767b356545d78979cd8f67610c66_amadey_cobalt-strike_elex_floxif_icedid_luca-stealer_njrat_stealc_vidar
- Size 6.4MB
- SHA256 4a7567ef93652c2d29ffa8732c4e471a6d76698197b57bfe9b7bb4e15ddf550d
- MD5 ec35767b356545d78979cd8f67610c66
- SHA1 ecea64b2a2ea71522a8c82b377f917ae3c18d0fa
- SHA512 46e7036d5c1c4f96a8ecf97acf8e0aa1345118aaedf9b531c9fe2fa975cb29592daeb6b532d4a4b759b0434e20c8cdb1c51394e42c52c28b0ca5e6298325c254
- SSDEEP 98304:7acgWC6MbNe3tx5H4ZwpLXr33EBqMUBB2Z6YfCuB0iSwgqdN5GAW:KlpIx5H2wpTABGT46YfCuB0bwfN5GAW
- TLSH
  T1F6669D1576E840E4E4B38130895A9A5FDAB5B9261B3147CF728C5B5F1F336D28E3B322
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor discovery floxif persistence privilege_escalation spyware stealer trojan upx
- Family: Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Detects Floxif payload
  backdoor
- Custom signature
  
  UPX dump on OEP (original entry point)
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2