floxif | 29350d624f1f93ef308f7960574ae9a1ef5122f7ef3a3394ca3557adfb63512e

General

Target
2026-11-13_8e660dc2c0a7075c9fa41f57b6befed0_amadey_coinminer_elex_floxif_glassworm_hijackloader_remcos_smoke-loader
Size 8.2MB
Sample261114-kt49wacv2n
SHA256 29350d624f1f93ef308f7960574ae9a1ef5122f7ef3a3394ca3557adfb63512e
MD5 8e660dc2c0a7075c9fa41f57b6befed0
SHA1 0b0f52d0abc1463e77e7b0a67b98f764a4297661
SHA512 0a16d1deb0ee93bedacf60a14cd8173861867c6d29ba0f60014d0afef0aea0850e602f1b2a8ff5f654aae1c2f64fd6d527b8bc7e7cea677fca36c8d2055247ee
SSDEEP 196608:5zNB7vIVxL4LHG8ZPy29gdCWqRgUVcu+qk29:5n8/L4L22K0lRpVeA9
TLSH
T10486BF55E3D34261CA42E6B9BF6CB2378E704F25E3530ED3F8985DCD12E2A8290B5359
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-11-13_8e660dc2c0a7075c9fa41f57b6befed0_amadey_coinminer_elex_floxif_glassworm_hijackloader_remcos_smoke-loader
- Size 8.2MB
- SHA256 29350d624f1f93ef308f7960574ae9a1ef5122f7ef3a3394ca3557adfb63512e
- MD5 8e660dc2c0a7075c9fa41f57b6befed0
- SHA1 0b0f52d0abc1463e77e7b0a67b98f764a4297661
- SHA512 0a16d1deb0ee93bedacf60a14cd8173861867c6d29ba0f60014d0afef0aea0850e602f1b2a8ff5f654aae1c2f64fd6d527b8bc7e7cea677fca36c8d2055247ee
- SSDEEP 196608:5zNB7vIVxL4LHG8ZPy29gdCWqRgUVcu+qk29:5n8/L4L22K0lRpVeA9
- TLSH
  T10486BF55E3D34261CA42E6B9BF6CB2378E704F25E3530ED3F8985DCD12E2A8290B5359
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor discovery floxif persistence privilege_escalation trojan upx
- Family: Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Detects Floxif payload
  backdoor
- Custom signature
  
  UPX dump on OEP (original entry point)
- Modifies AppInit DLL entries
  Modifies the AppInit_DLLs registry setting, allowing a specified DLL to be loaded automatically into almost every Windows process across reboots.
  persistence privilege_escalation
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2