farfli | 127cc5b9240c31a4846707e7a182e232a76b0e9dfa38f2757ba4d5b67291706c

General

Target
2026-04-23_a05c24d4d143458c09ec3aa7a08a04c5_elex_wannacry
Size 220KB
Sample260423-lskphsg13x
SHA256 127cc5b9240c31a4846707e7a182e232a76b0e9dfa38f2757ba4d5b67291706c
MD5 a05c24d4d143458c09ec3aa7a08a04c5
SHA1 729f0da4a1372b509e58a6b78a967a5f7b706cb6
SHA512 74353a779248bf276604848b36772d85eb66c26f6980347aa876efc37cdbf235300aaeba0a9c6c4fcf7bb83efbbc97f6bca480272344c7717999d9081557b990
SSDEEP 6144:LMPTxAnyi9awI2WXyZPbwdpLr7FQXSzK:4PTPjnCCdpO
TLSH
T1DA24F111D6D6C1D9D07247FA8E3BC539CC1AAE261F0865C332563B6AA875DE1AF3102F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-04-23_a05c24d4d143458c09ec3aa7a08a04c5_elex_wannacry
- Size 220KB
- SHA256 127cc5b9240c31a4846707e7a182e232a76b0e9dfa38f2757ba4d5b67291706c
- MD5 a05c24d4d143458c09ec3aa7a08a04c5
- SHA1 729f0da4a1372b509e58a6b78a967a5f7b706cb6
- SHA512 74353a779248bf276604848b36772d85eb66c26f6980347aa876efc37cdbf235300aaeba0a9c6c4fcf7bb83efbbc97f6bca480272344c7717999d9081557b990
- SSDEEP 6144:LMPTxAnyi9awI2WXyZPbwdpLr7FQXSzK:4PTPjnCCdpO
- TLSH
  T1DA24F111D6D6C1D9D07247FA8E3BC539CC1AAE261F0865C332563B6AA875DE1AF3102F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

aspackv2 backdoor bootkit discovery farfli persistence spyware stealer vmprotect
- Detects Farfli Backdoor
- Family: Farfli
  Farfli is a Windows backdoor written in C++.
  backdoor farfli
- Detects executables containing base64 encoded User Agent
- Detects executables packed with VMProtect.
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- VMProtect packed file
  Detects executables packed with VMProtect commercial packer.
  vmprotect
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral1 behavioral2