floxif | 70b57d7586c6bc9e42d3df550458a0c3c40a5d7b63e7ad63d15b8adf70f2b322

General

Target
2026-11-07_440a3ae823fcae6a60c0735a31cb00b1_coinminer_elex_floxif_manuscrypt_rhadamanthys_stop
Size 34.0MB
Sample261109-k8jlqaec53
SHA256 70b57d7586c6bc9e42d3df550458a0c3c40a5d7b63e7ad63d15b8adf70f2b322
MD5 440a3ae823fcae6a60c0735a31cb00b1
SHA1 790db7f5a76b703cd14d816b707f435fb9d11839
SHA512 7b427b3a56a01c1a32497508de70778839c3d15e7d17699887254faeac811a5e30c76d8ccdf52b18350726bd61f6546244cb649473369095c3854f196fc57bb6
SSDEEP 786432:vByRfTtLeu9wu0q9Z5BAiL9leZnCF8mqzt4y:vByRfTtLeFqz5BZL+gFxuL
TLSH
T189773302BB868672F44A163948A71B798BF76C65AF3393CB63507B1D2C333D16B34256
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-11-07_440a3ae823fcae6a60c0735a31cb00b1_coinminer_elex_floxif_manuscrypt_rhadamanthys_stop
- Size 34.0MB
- SHA256 70b57d7586c6bc9e42d3df550458a0c3c40a5d7b63e7ad63d15b8adf70f2b322
- MD5 440a3ae823fcae6a60c0735a31cb00b1
- SHA1 790db7f5a76b703cd14d816b707f435fb9d11839
- SHA512 7b427b3a56a01c1a32497508de70778839c3d15e7d17699887254faeac811a5e30c76d8ccdf52b18350726bd61f6546244cb649473369095c3854f196fc57bb6
- SSDEEP 786432:vByRfTtLeu9wu0q9Z5BAiL9leZnCF8mqzt4y:vByRfTtLeFqz5BZL+gFxuL
- TLSH
  T189773302BB868672F44A163948A71B798BF76C65AF3393CB63507B1D2C333D16B34256
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor discovery floxif trojan upx persistence privilege_escalation
- Family: Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Detects Floxif payload
  backdoor
- Custom signature
  
  UPX dump on OEP (original entry point)
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2