floxif | 2e0f35db061d8e4e4c8ff189b644a493ed76c90621a5df6949ec5ec0aa5e4182

General

Target
2026-11-13_295eb9fe5121d7ac00067e7361c7a3d6_amadey_elex_floxif_redline-stealer_rhadamanthys_smoke-loader_stop
Size 4.3MB
Sample261114-vrlpvssw3l
SHA256 2e0f35db061d8e4e4c8ff189b644a493ed76c90621a5df6949ec5ec0aa5e4182
MD5 295eb9fe5121d7ac00067e7361c7a3d6
SHA1 45a9125e9eca34c039a2bdd6516a17dbfc93da0a
SHA512 6991f771526b75aede71743dca1afd5492f2fd1fd588ebbdb3ef152ecd6e28fd476817009e3283f613e81f4e0e7f13e6f8340a45a23cfbff070b367b864d3f89
SSDEEP 98304:m3wHQopI9NSReE92MkE40twtXfVw3WWlH8z+hmcW6Lh8wS62hcnjsfvaSN:3woqjE01EPoXfVw3RU3AuwSb4QfvaSN
TLSH
T1B72623549A51C3BAF04175B01B4845F49AE1DD280C3680BA77D836CEDB38DA39FAB379
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-11-13_295eb9fe5121d7ac00067e7361c7a3d6_amadey_elex_floxif_redline-stealer_rhadamanthys_smoke-loader_stop
- Size 4.3MB
- SHA256 2e0f35db061d8e4e4c8ff189b644a493ed76c90621a5df6949ec5ec0aa5e4182
- MD5 295eb9fe5121d7ac00067e7361c7a3d6
- SHA1 45a9125e9eca34c039a2bdd6516a17dbfc93da0a
- SHA512 6991f771526b75aede71743dca1afd5492f2fd1fd588ebbdb3ef152ecd6e28fd476817009e3283f613e81f4e0e7f13e6f8340a45a23cfbff070b367b864d3f89
- SSDEEP 98304:m3wHQopI9NSReE92MkE40twtXfVw3WWlH8z+hmcW6Lh8wS62hcnjsfvaSN:3woqjE01EPoXfVw3RU3AuwSb4QfvaSN
- TLSH
  T1B72623549A51C3BAF04175B01B4845F49AE1DD280C3680BA77D836CEDB38DA39FAB379
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor defense_evasion discovery floxif trojan upx
- Family: Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Detects Floxif payload
  backdoor
- Custom signature
  
  UPX dump on OEP (original entry point)
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Executes dropped EXE
- Loads dropped DLL
- Writes a Windows system DLL name to a user directory
  A module named after a system DLL outside System32 can be loaded instead of the real one by a program searching that directory.
  defense_evasion
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2