floxif | db7b5b1f9ad6f746455469adb523bf3c2a801f05b532ad69a9000fee9c96eae7

General

Target
2026-11-11_4823967ddd293489543523a8e2af6372_amadey_elex_floxif_neshta_ransomhub_smoke-loader_stop
Size 822KB
Sample261113-qejyaab13s
SHA256 db7b5b1f9ad6f746455469adb523bf3c2a801f05b532ad69a9000fee9c96eae7
MD5 4823967ddd293489543523a8e2af6372
SHA1 74b83e292af395bea7f4595ca24f5701c26a94a5
SHA512 b4b5cb5021329e7e2beba481e8256633c5fffb965104ae0bb80146881643a75ad94681eaf3d1303d92b69b28a75aa5b9d62b6088efa3143a2905bf51403a9854
SSDEEP 12288:tiy6AOrPlBAouvnfyeYKBRyB+3rIpfQuPw8qITfBjvrEH7WF:tiy614nfSKCBOrIpfDoXMrEH7w
TLSH
T14E05BF07B6A3C2F2E47155B461A6B33A4633BD2527DA96E3A3933909EC312D11F3D364
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-11-11_4823967ddd293489543523a8e2af6372_amadey_elex_floxif_neshta_ransomhub_smoke-loader_stop
- Size 822KB
- SHA256 db7b5b1f9ad6f746455469adb523bf3c2a801f05b532ad69a9000fee9c96eae7
- MD5 4823967ddd293489543523a8e2af6372
- SHA1 74b83e292af395bea7f4595ca24f5701c26a94a5
- SHA512 b4b5cb5021329e7e2beba481e8256633c5fffb965104ae0bb80146881643a75ad94681eaf3d1303d92b69b28a75aa5b9d62b6088efa3143a2905bf51403a9854
- SSDEEP 12288:tiy6AOrPlBAouvnfyeYKBRyB+3rIpfQuPw8qITfBjvrEH7WF:tiy614nfSKCBOrIpfDoXMrEH7w
- TLSH
  T14E05BF07B6A3C2F2E47155B461A6B33A4633BD2527DA96E3A3933909EC312D11F3D364
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor discovery floxif neshta persistence spyware stealer trojan upx
- Detect Neshta payload
- Family: Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Family: Neshta
  Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
  persistence spyware neshta
- Detects Floxif payload
  backdoor
- Custom signature
  
  UPX dump on OEP (original entry point)
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
  persistence
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2