floxif | 34a4c12c4434e61e7bf39e011b396ce8760f401b9e70aefb6bac13bb5ee55d96

General

Target
2026-11-12_dd1453e902f8a87254645c8f16ac3c5d_elex_floxif_glassworm_icedid_smoke-loader_stop
Size 3.5MB
Sample261112-sem12sht2w
SHA256 34a4c12c4434e61e7bf39e011b396ce8760f401b9e70aefb6bac13bb5ee55d96
MD5 dd1453e902f8a87254645c8f16ac3c5d
SHA1 73c0223e1e33b81343044836d279cd0ee707f033
SHA512 fc56ab977ec2649a668948c3c53fbeb005e19ce6fd9b034098455430c8285b068716782538d5abee1db9bc245b6c6c9c2a5753c8a41ff14876c5b3cff34885c8
SSDEEP 49152:hm0ypsjYOQoEcddsx6qkuGPH5PQovqKaDTioYUZopoTyn6:hm0is8OQ0ddsxulH5B6
TLSH
T1EA065C22E303C13EE5A301BDC46D5B6A5294AF2017F551D7AFC8385D1EBAED19A3A307
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-11-12_dd1453e902f8a87254645c8f16ac3c5d_elex_floxif_glassworm_icedid_smoke-loader_stop
- Size 3.5MB
- SHA256 34a4c12c4434e61e7bf39e011b396ce8760f401b9e70aefb6bac13bb5ee55d96
- MD5 dd1453e902f8a87254645c8f16ac3c5d
- SHA1 73c0223e1e33b81343044836d279cd0ee707f033
- SHA512 fc56ab977ec2649a668948c3c53fbeb005e19ce6fd9b034098455430c8285b068716782538d5abee1db9bc245b6c6c9c2a5753c8a41ff14876c5b3cff34885c8
- SSDEEP 49152:hm0ypsjYOQoEcddsx6qkuGPH5PQovqKaDTioYUZopoTyn6:hm0is8OQ0ddsxulH5B6
- TLSH
  T1EA065C22E303C13EE5A301BDC46D5B6A5294AF2017F551D7AFC8385D1EBAED19A3A307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor discovery floxif persistence privilege_escalation trojan upx
- Family: Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Detects Floxif payload
  backdoor
- Custom signature
  
  UPX dump on OEP (original entry point)
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2