floxif | 7f8786b43a91e0a835a978674cacdb7af05554b2068419fed90c726bf0646785

General

Target
2026-11-13_b85299b36d4828bb855c16d67085daed_amadey_elex_floxif_smoke-loader_stop
Size 4.7MB
Sample261114-al64dstx3l
SHA256 7f8786b43a91e0a835a978674cacdb7af05554b2068419fed90c726bf0646785
MD5 b85299b36d4828bb855c16d67085daed
SHA1 c251ee13ba5bc24332d48801a6afd07d2e1a3410
SHA512 9abe3e102da1ddf3f676ab42aef46410440fc4a6d9d0a00f4e16ed83e04a3b5021d8bf2d036aa7677fc71dbccb085130aa0200b8238b8c73308eb185877b2e7a
SSDEEP 98304:u0dPlpKnp1hiz+Pd/GNUvx7tHw6dSXXahK9aZQ+3QuNR6RbXx7vI9PJb:umpWp1jVvLtdSXXahKMZQ+3QuNR6h9Kt
TLSH
T1D0369D81FAC5C1B2C512097001BAF62987319F496722D2D3F4D83FAA5F33AD1957B98E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-11-13_b85299b36d4828bb855c16d67085daed_amadey_elex_floxif_smoke-loader_stop
- Size 4.7MB
- SHA256 7f8786b43a91e0a835a978674cacdb7af05554b2068419fed90c726bf0646785
- MD5 b85299b36d4828bb855c16d67085daed
- SHA1 c251ee13ba5bc24332d48801a6afd07d2e1a3410
- SHA512 9abe3e102da1ddf3f676ab42aef46410440fc4a6d9d0a00f4e16ed83e04a3b5021d8bf2d036aa7677fc71dbccb085130aa0200b8238b8c73308eb185877b2e7a
- SSDEEP 98304:u0dPlpKnp1hiz+Pd/GNUvx7tHw6dSXXahK9aZQ+3QuNR6RbXx7vI9PJb:umpWp1jVvLtdSXXahKMZQ+3QuNR6h9Kt
- TLSH
  T1D0369D81FAC5C1B2C512097001BAF62987319F496722D2D3F4D83FAA5F33AD1957B98E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor discovery floxif trojan upx persistence privilege_escalation
- Family: Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Detects Floxif payload
  backdoor
- Custom signature
  
  UPX dump on OEP (original entry point)
- Modifies AppInit DLL entries
  Modifies the AppInit_DLLs registry setting, allowing a specified DLL to be loaded automatically into almost every Windows process across reboots.
  persistence privilege_escalation
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2