farfli | 03234994e4e83a65f15f69b0c65b7524c4c8b280240a8538edc38ef5deb68801

General

Target
2026-04-20_a563e6db5dfe794d5c0afcea12f10dad_coinminer_elex_wannacry
Size 303KB
Sample260420-lcjghset4q
SHA256 03234994e4e83a65f15f69b0c65b7524c4c8b280240a8538edc38ef5deb68801
MD5 a563e6db5dfe794d5c0afcea12f10dad
SHA1 9673f9677def85df60df05d453283c4a8388045f
SHA512 1ff8d516b3644c1e43f126d8c3699847282e610a784d0dfff536219c54bc23ba1dfa8b294bf83af229a481097f7342b5f5b22f0a096e4b51ab42ee50a6fbdc9a
SSDEEP 6144:glYAIeOcaxmlJaErfbMCurC7xS3ZMOBnskyrO:ywLcCmuErglr73aAD+
TLSH
T18664F182D501CF47FC2FCAB6823E5E351317AF552B205593D3C4BA1F66B2A42A63E0D9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-04-20_a563e6db5dfe794d5c0afcea12f10dad_coinminer_elex_wannacry
- Size 303KB
- SHA256 03234994e4e83a65f15f69b0c65b7524c4c8b280240a8538edc38ef5deb68801
- MD5 a563e6db5dfe794d5c0afcea12f10dad
- SHA1 9673f9677def85df60df05d453283c4a8388045f
- SHA512 1ff8d516b3644c1e43f126d8c3699847282e610a784d0dfff536219c54bc23ba1dfa8b294bf83af229a481097f7342b5f5b22f0a096e4b51ab42ee50a6fbdc9a
- SSDEEP 6144:glYAIeOcaxmlJaErfbMCurC7xS3ZMOBnskyrO:ywLcCmuErglr73aAD+
- TLSH
  T18664F182D501CF47FC2FCAB6823E5E351317AF552B205593D3C4BA1F66B2A42A63E0D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor bootkit discovery farfli persistence spyware stealer upx
- Detects Farfli Backdoor
- Family: Farfli
  Farfli is a Windows backdoor written in C++.
  backdoor farfli
- Custom signature
  
  Detects executables containing base64 encoded User Agent
- Custom signature
  
  UPX dump on OEP (original entry point)
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2