floxif | f5b427c750e6cd5e2fcb53b9c6cd5df9491c4fbc63362609b7c8eaec0b6f2b27

General

Target
2026-11-14_aab44aa8795479e08aa089fdc396382a_coinminer_elex_floxif_wannacry
Size 3.2MB
Sample261115-k288ssbs8y
SHA256 f5b427c750e6cd5e2fcb53b9c6cd5df9491c4fbc63362609b7c8eaec0b6f2b27
MD5 aab44aa8795479e08aa089fdc396382a
SHA1 f0f12b2305fed3014c7bdab50b20b55a76db10da
SHA512 bf739e05ff24f9ce3b326763f3d835f8784716e0d9de164c4f8dbd973249c52e6c2cab8f3acf3d4ad61861fe2dd540ec2d3e31c44ef789317c1fb798232a5150
SSDEEP 98304:jda2ItlrXzqs0aAsOp6Os9Yx1zDbHVsAy2s67dUTT:jda9tlrXzVAVpBsy/vb1sA7Z74T
TLSH
T125F5336337A18BF8C1D5563E34896F4408F1E93F2F46A5C3D3524CC66FAC1A6AA7A047
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-11-14_aab44aa8795479e08aa089fdc396382a_coinminer_elex_floxif_wannacry
- Size 3.2MB
- SHA256 f5b427c750e6cd5e2fcb53b9c6cd5df9491c4fbc63362609b7c8eaec0b6f2b27
- MD5 aab44aa8795479e08aa089fdc396382a
- SHA1 f0f12b2305fed3014c7bdab50b20b55a76db10da
- SHA512 bf739e05ff24f9ce3b326763f3d835f8784716e0d9de164c4f8dbd973249c52e6c2cab8f3acf3d4ad61861fe2dd540ec2d3e31c44ef789317c1fb798232a5150
- SSDEEP 98304:jda2ItlrXzqs0aAsOp6Os9Yx1zDbHVsAy2s67dUTT:jda9tlrXzVAVpBsy/vb1sA7Z74T
- TLSH
  T125F5336337A18BF8C1D5563E34896F4408F1E93F2F46A5C3D3524CC66FAC1A6AA7A047
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor discovery floxif persistence trojan upx privilege_escalation
- Family: Floxif, Floodfix
  Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
  backdoor trojan floxif
- Detects Floxif payload
  backdoor
- Custom signature
  
  UPX dump on OEP (original entry point)
- Modifies AppInit DLL entries
  Modifies the AppInit_DLLs registry setting, allowing a specified DLL to be loaded automatically into almost every Windows process across reboots.
  persistence privilege_escalation
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2