floxif | b478feaa0baab1630f7d7a8af6f7b70f2741bff64ef3cc0e1df3847d5af606e8

General

Target
2026-11-10_8a31b64f415f97adc71997e2532fc857_amadey_elex_floxif_redline-stealer_rhadamanthys_smoke-loader_stop
Size 258KB
Sample261110-hdbarade44
SHA256 b478feaa0baab1630f7d7a8af6f7b70f2741bff64ef3cc0e1df3847d5af606e8
MD5 8a31b64f415f97adc71997e2532fc857
SHA1 6891125f0b006693b190e718c09edc26f330f3d6
SHA512 b48a3cfe3874073ba9df16d2581a77ce323d6d76e9d1d1e424cf1e3b527f90f6ee9862eaed5d3707c261037401cb327c361fa309d862995b9485e45a4a80276d
SSDEEP 6144:GnR8u67ZAYDul7CcX3/VbsQvMRlkM4RD/qzMfUy:Guu67ry9dMRGM4h/qoff
TLSH
T18344CF423B51D3F9D4101830305ED3461BE9FD3D0A6E6583F7123A5A2E3E3979A66A1F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-11-10_8a31b64f415f97adc71997e2532fc857_amadey_elex_floxif_redline-stealer_rhadamanthys_smoke-loader_stop
- Size 258KB
- SHA256 b478feaa0baab1630f7d7a8af6f7b70f2741bff64ef3cc0e1df3847d5af606e8
- MD5 8a31b64f415f97adc71997e2532fc857
- SHA1 6891125f0b006693b190e718c09edc26f330f3d6
- SHA512 b48a3cfe3874073ba9df16d2581a77ce323d6d76e9d1d1e424cf1e3b527f90f6ee9862eaed5d3707c261037401cb327c361fa309d862995b9485e45a4a80276d
- SSDEEP 6144:GnR8u67ZAYDul7CcX3/VbsQvMRlkM4RD/qzMfUy:Guu67ry9dMRGM4h/qoff
- TLSH
  T18344CF423B51D3F9D4101830305ED3461BE9FD3D0A6E6583F7123A5A2E3E3979A66A1F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor defense_evasion discovery floxif persistence privilege_escalation trojan upx
- Family: Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Modifies visibility of file extensions in Explorer
  defense_evasion
- Modifies visibility of hidden/system files in Explorer
  defense_evasion
- Detects Floxif payload
  backdoor
- Custom signature
  
  UPX dump on OEP (original entry point)
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Network Service Discovery
  Attempt to gather information on host's network.
  discovery
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2