floxif | edd28425c32c4063aeb5a44fb7607c845e902536da458780f3656a85475dd13c

General

Target
2026-11-13_e2207b91578a706599b10656039b5daa_amadey_cobalt-strike_elex_floxif_hellokitty_luca-stealer_njrat
Size 935KB
Sample261113-zw52hsfx9p
SHA256 edd28425c32c4063aeb5a44fb7607c845e902536da458780f3656a85475dd13c
MD5 e2207b91578a706599b10656039b5daa
SHA1 3d0163fa8e1590c8218358f33862a5b30721637d
SHA512 aedd6353f91fcde4ad3454b80c59a3a442a3332fb40a4ba793a08d7cde2497de95091d3c8519a6a558f64f1265da409d844db8c0809ae59706661609b2cbf517
SSDEEP 12288:+qSuNl3cvL3WvL3L+FrgVWtXECAquCcyuIWu6Rw9qdLLS7/CltBjvrEH7/:/bVcvSvSEPqZ47unMZLSuRrEH7/
TLSH
T10315E1507B85CBB1E0341F3038777E70ABF4FD79692AB64F6D0078965AB72D12022A5B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-11-13_e2207b91578a706599b10656039b5daa_amadey_cobalt-strike_elex_floxif_hellokitty_luca-stealer_njrat
- Size 935KB
- SHA256 edd28425c32c4063aeb5a44fb7607c845e902536da458780f3656a85475dd13c
- MD5 e2207b91578a706599b10656039b5daa
- SHA1 3d0163fa8e1590c8218358f33862a5b30721637d
- SHA512 aedd6353f91fcde4ad3454b80c59a3a442a3332fb40a4ba793a08d7cde2497de95091d3c8519a6a558f64f1265da409d844db8c0809ae59706661609b2cbf517
- SSDEEP 12288:+qSuNl3cvL3WvL3L+FrgVWtXECAquCcyuIWu6Rw9qdLLS7/CltBjvrEH7/:/bVcvSvSEPqZ47unMZLSuRrEH7/
- TLSH
  T10315E1507B85CBB1E0341F3038777E70ABF4FD79692AB64F6D0078965AB72D12022A5B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor discovery floxif installer trojan upx persistence privilege_escalation
- Family: Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Detects Floxif payload
  backdoor
- Custom signature
  
  UPX dump on OEP (original entry point)
- Downloads MZ/PE file
- Modifies AppInit DLL entries
  Modifies the AppInit_DLLs registry setting, allowing a specified DLL to be loaded automatically into almost every Windows process across reboots.
  persistence privilege_escalation
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2