floxif | ac3ad4f4b09c54b35cbf3e797f4d4c40b291de1c0335934d7a252c0c767d62b6

General

Target
2026-11-08_94cee528178a255bcaa2b496fab07ef4_agent-tesla_darkgate_elex_floxif_hawkeye_maze_remcos
Size 920KB
Sample261108-3ekk2ags5s
SHA256 ac3ad4f4b09c54b35cbf3e797f4d4c40b291de1c0335934d7a252c0c767d62b6
MD5 94cee528178a255bcaa2b496fab07ef4
SHA1 d72300c7de61d964a47fb9b3c28f67c4bb4a67f6
SHA512 3e277522448a5b8ab6afceeaa8d0ca9f5d921882b0f6d843f8572a8144bdcaa0d82fda208ac2a1187de065a22456c19cf9a2e98ab1ae493b9cdeb8444f2c41fb
SSDEEP 12288:HCdOy3vVrKwR5CXbNjAOxK/j2n+4YG/6tLmFFja3mXgcjfRlgsUBgaoiSNQHBjvx:HCdxt3/80jYLu3U1jfsWaNSNQFrEH7x6
TLSH
T1FB15AD2273DDC3A4CB769133BF6A73016EBB78690634B85B2F880D79AD50171266C763
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-11-08_94cee528178a255bcaa2b496fab07ef4_agent-tesla_darkgate_elex_floxif_hawkeye_maze_remcos
- Size 920KB
- SHA256 ac3ad4f4b09c54b35cbf3e797f4d4c40b291de1c0335934d7a252c0c767d62b6
- MD5 94cee528178a255bcaa2b496fab07ef4
- SHA1 d72300c7de61d964a47fb9b3c28f67c4bb4a67f6
- SHA512 3e277522448a5b8ab6afceeaa8d0ca9f5d921882b0f6d843f8572a8144bdcaa0d82fda208ac2a1187de065a22456c19cf9a2e98ab1ae493b9cdeb8444f2c41fb
- SSDEEP 12288:HCdOy3vVrKwR5CXbNjAOxK/j2n+4YG/6tLmFFja3mXgcjfRlgsUBgaoiSNQHBjvx:HCdxt3/80jYLu3U1jfsWaNSNQFrEH7x6
- TLSH
  T1FB15AD2273DDC3A4CB769133BF6A73016EBB78690634B85B2F880D79AD50171266C763
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor discovery floxif persistence privilege_escalation trojan upx
- Family: Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Detects Floxif payload
  backdoor
- Custom signature
  
  UPX dump on OEP (original entry point)
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2