farfli | b016e0da12650a927e6292e95737a61f00e640ac4e0a2b7eae7c72b17ee67497

General

Target
2026-05-03_1009c08b46949bcba34883258cfb4607_elex_wannacry
Size 90KB
Sample260503-qdvndsc13p
SHA256 b016e0da12650a927e6292e95737a61f00e640ac4e0a2b7eae7c72b17ee67497
MD5 1009c08b46949bcba34883258cfb4607
SHA1 37b1666aa6a5c66ae422f75b28c01b2ba94abdda
SHA512 d1e6b51e4ca423604aeac112db1c342c2ca62ef0bc73c3c6b2c0cb9e41ce26f4955375411480e47652dafcdbcee089a7102e89a0759d3a884ead67991e34899a
SSDEEP 1536:TSSABNx6vb4RoI47zzzzzzzzzvfxzVzNrzzzgzzzzzzzzzzzzzzzz6zzzdzzzzlB:eSABNx6vb4RoI4pyjHYLhal01UoPX+h0
TLSH
T13393CF07ABA948C9F221BC30156E3B7587BF985D7F1457979348EE4E9433D80EC3628A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-05-03_1009c08b46949bcba34883258cfb4607_elex_wannacry
- Size 90KB
- SHA256 b016e0da12650a927e6292e95737a61f00e640ac4e0a2b7eae7c72b17ee67497
- MD5 1009c08b46949bcba34883258cfb4607
- SHA1 37b1666aa6a5c66ae422f75b28c01b2ba94abdda
- SHA512 d1e6b51e4ca423604aeac112db1c342c2ca62ef0bc73c3c6b2c0cb9e41ce26f4955375411480e47652dafcdbcee089a7102e89a0759d3a884ead67991e34899a
- SSDEEP 1536:TSSABNx6vb4RoI47zzzzzzzzzvfxzVzNrzzzgzzzzzzzzzzzzzzzz6zzzdzzzzlB:eSABNx6vb4RoI4pyjHYLhal01UoPX+h0
- TLSH
  T13393CF07ABA948C9F221BC30156E3B7587BF985D7F1457979348EE4E9433D80EC3628A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor bootkit discovery farfli persistence spyware stealer
- Detects Farfli Backdoor
- Family: Farfli
  Farfli is a Windows backdoor written in C++.
  backdoor farfli
- Detects executables containing base64 encoded User Agent
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral1 behavioral2