floxif | 8cac79fcf4dea31cc564f22f03483af5dca082239734bfef6b90e253b66de4b7

General

Target
2026-11-07_4db31da218f03ffea09c85a57265d3e6_coinminer_driverpack_elex_floxif_wannacry
Size 3.2MB
Sample261108-s7kfma11hs
SHA256 8cac79fcf4dea31cc564f22f03483af5dca082239734bfef6b90e253b66de4b7
MD5 4db31da218f03ffea09c85a57265d3e6
SHA1 6434ed8041a2ad562bfc30fb965693035fdb9e54
SHA512 8d7c45107d71a6f115e1ee7d3bfc8f76376f5f0b4727c86776b3c64efd4ce0522f50d16d8ac8b88b5611d634e6457fa0a48c2c315cffc319f14e1fe6bcb73f0b
SSDEEP 98304:55aFXo8YT5GpT334f8gWFsZu35uQ5Q5vnaE:55aFXo82kTeWFsZupXqnaE
TLSH
T16FF5334173A197FAD2E22271BA45332645FAFB7E077A80C383613D017D6D2D36A746CA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-11-07_4db31da218f03ffea09c85a57265d3e6_coinminer_driverpack_elex_floxif_wannacry
- Size 3.2MB
- SHA256 8cac79fcf4dea31cc564f22f03483af5dca082239734bfef6b90e253b66de4b7
- MD5 4db31da218f03ffea09c85a57265d3e6
- SHA1 6434ed8041a2ad562bfc30fb965693035fdb9e54
- SHA512 8d7c45107d71a6f115e1ee7d3bfc8f76376f5f0b4727c86776b3c64efd4ce0522f50d16d8ac8b88b5611d634e6457fa0a48c2c315cffc319f14e1fe6bcb73f0b
- SSDEEP 98304:55aFXo8YT5GpT334f8gWFsZu35uQ5Q5vnaE:55aFXo82kTeWFsZupXqnaE
- TLSH
  T16FF5334173A197FAD2E22271BA45332645FAFB7E077A80C383613D017D6D2D36A746CA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor defense_evasion discovery floxif trojan upx persistence privilege_escalation
- Family: Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Detects Floxif payload
  backdoor
- Custom signature
  
  UPX dump on OEP (original entry point)
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2