General
- Target 2026-11-13_6e8052e5c57488c6621c64abd55563d6_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz
- Size 4.5MB
- Sample261114-nfapwsf12y
- SHA256 37f9f893b593006bc2bbe7fd7ab21f402c5098717ccb18298b2f3f62b5e0614c
Malware Config
Targets
-
- Target 2026-11-13_6e8052e5c57488c6621c64abd55563d6_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz
- Size 4.5MB
- SHA256 37f9f893b593006bc2bbe7fd7ab21f402c5098717ccb18298b2f3f62b5e0614c
Score10/10Family: Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
Detects Floxif payload
- Custom signature
UPX dump on OEP (original entry point)
Modifies AppInit DLL entries
Modifies the AppInit_DLLs registry setting, allowing a specified DLL to be loaded automatically into almost every Windows process across reboots.
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
Executes dropped EXE
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Loads dropped DLL
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
MITRE ATT&CK Enterprise v16
Discovery
Browser Information Discovery
1Peripheral Device Discovery
2Query Registry
5System Information Discovery
5System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1System Time Discovery
1Virtualization/Sandbox Evasion
1