floxif | e299172db95ce84fefdd56da39d939e5701fa7d9bf9f3b8d8683ffcf761dd099

General

Target
2026-11-09_fe57f82654d6cac6b045ba352c985560_elex_floxif_redline-stealer_rhadamanthys_stop_tofsee
Size 2.6MB
Sample261109-rsm3jayv2k
SHA256 e299172db95ce84fefdd56da39d939e5701fa7d9bf9f3b8d8683ffcf761dd099
MD5 fe57f82654d6cac6b045ba352c985560
SHA1 770f1c0fd1131ee857566aaea12778ce1851da44
SHA512 95905af466b95123c39131a8e1cae4336227df3b6c0c8aa0329805b3807447f52da564bcd1c7e8836203693b4f5d5ed0c8c0b51aa91eb403e2d22b0ad92456aa
SSDEEP 49152:7mTRR0i90cyIw/wj3ka4NSV9dvLWqbURdk/qy3pvY2dPLUBIIOpyZP1Qph:7o0i90TIc4UJSpvLWdQZ3pvtdPw2IOpD
TLSH
T18CC5332336C4D7FAC425513068654926AAB4BC3F0B6486DFF329732E4F7D2969D3930A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-11-09_fe57f82654d6cac6b045ba352c985560_elex_floxif_redline-stealer_rhadamanthys_stop_tofsee
- Size 2.6MB
- SHA256 e299172db95ce84fefdd56da39d939e5701fa7d9bf9f3b8d8683ffcf761dd099
- MD5 fe57f82654d6cac6b045ba352c985560
- SHA1 770f1c0fd1131ee857566aaea12778ce1851da44
- SHA512 95905af466b95123c39131a8e1cae4336227df3b6c0c8aa0329805b3807447f52da564bcd1c7e8836203693b4f5d5ed0c8c0b51aa91eb403e2d22b0ad92456aa
- SSDEEP 49152:7mTRR0i90cyIw/wj3ka4NSV9dvLWqbURdk/qy3pvY2dPLUBIIOpyZP1Qph:7o0i90TIc4UJSpvLWdQZ3pvtdPw2IOpD
- TLSH
  T18CC5332336C4D7FAC425513068654926AAB4BC3F0B6486DFF329732E4F7D2969D3930A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor discovery floxif persistence privilege_escalation trojan upx
- Family: Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Detects Floxif payload
  backdoor
- Custom signature
  
  UPX dump on OEP (original entry point)
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2