farfli | 2b79db592f56ee2527f63755ddf55ee4bd83700002e0d83f096331bd54618c6c

General

Target
2026-04-16_0102af8259680e1d7f560ab432eee0d9_elex_wannacry
Size 97KB
Sample260416-kapp3sa13m
SHA256 2b79db592f56ee2527f63755ddf55ee4bd83700002e0d83f096331bd54618c6c
MD5 0102af8259680e1d7f560ab432eee0d9
SHA1 14f1c21c857dab2520cfffa31569e4ed42d167df
SHA512 7572185ff9425c168a7be74c2a550d6a37c0ba7d9b268336d798821168935798f7c2dfa63426e26a43ef76db2717a84c3468a0008b80097249b00e30fb4c7b83
SSDEEP 3072:eSABNx6vb4RoI4pyjHYLhal01UoPX+hwo6:el69Ml0TE
TLSH
T151A3AE035BB588C9E5216C34562E7730C7BEA85D3B1457639388EE4EE837D85EC3628A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-04-16_0102af8259680e1d7f560ab432eee0d9_elex_wannacry
- Size 97KB
- SHA256 2b79db592f56ee2527f63755ddf55ee4bd83700002e0d83f096331bd54618c6c
- MD5 0102af8259680e1d7f560ab432eee0d9
- SHA1 14f1c21c857dab2520cfffa31569e4ed42d167df
- SHA512 7572185ff9425c168a7be74c2a550d6a37c0ba7d9b268336d798821168935798f7c2dfa63426e26a43ef76db2717a84c3468a0008b80097249b00e30fb4c7b83
- SSDEEP 3072:eSABNx6vb4RoI4pyjHYLhal01UoPX+hwo6:el69Ml0TE
- TLSH
  T151A3AE035BB588C9E5216C34562E7730C7BEA85D3B1457639388EE4EE837D85EC3628A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor bootkit discovery farfli persistence spyware stealer
- Detects Farfli Backdoor
- Family: Farfli
  Farfli is a Windows backdoor written in C++.
  backdoor farfli
- Custom signature
  
  Detects executables containing base64 encoded User Agent
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral1 behavioral2