farfli | 8d15d6808e2bc10b794700631283ad07c852d4303f2544f466f06cd71275c196

General

Target
2026-06-02_755601f044f9381bd068eb2dce1e3973_elex_wannacry
Size 222KB
Sample260602-eaexzsev9j
SHA256 8d15d6808e2bc10b794700631283ad07c852d4303f2544f466f06cd71275c196
MD5 755601f044f9381bd068eb2dce1e3973
SHA1 ed8f889f217d6fbc1021247dda5143aac2a11d4c
SHA512 9cb87881e0a54a1c3ba8db219d6855e7ac3c70fe983b14f7576f9aebb26986714ccb9a1d5c83e8dcc81e9683ea939fd52b14e688aff69bf579d76566802f1857
SSDEEP 6144:LMPTxAnyi9awI2WXyZPbwdpLr7FQXSzK:4PTPjnCCdpO
TLSH
T1D724E011D6D2C1D9D07247F68E3BC539CC1AAE261F0865C332563B6AA475EE0AF7102F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-06-02_755601f044f9381bd068eb2dce1e3973_elex_wannacry
- Size 222KB
- SHA256 8d15d6808e2bc10b794700631283ad07c852d4303f2544f466f06cd71275c196
- MD5 755601f044f9381bd068eb2dce1e3973
- SHA1 ed8f889f217d6fbc1021247dda5143aac2a11d4c
- SHA512 9cb87881e0a54a1c3ba8db219d6855e7ac3c70fe983b14f7576f9aebb26986714ccb9a1d5c83e8dcc81e9683ea939fd52b14e688aff69bf579d76566802f1857
- SSDEEP 6144:LMPTxAnyi9awI2WXyZPbwdpLr7FQXSzK:4PTPjnCCdpO
- TLSH
  T1D724E011D6D2C1D9D07247F68E3BC539CC1AAE261F0865C332563B6AA475EE0AF7102F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

aspackv2 backdoor bootkit discovery farfli persistence spyware stealer vmprotect
- Detects Farfli Backdoor
- Family: Farfli
  Farfli is a Windows backdoor written in C++.
  backdoor farfli
- Custom signature
  
  Detects executables containing base64 encoded User Agent
- Custom signature
  
  Detects executables packed with VMProtect.
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- VMProtect packed file
  Detects executables packed with VMProtect commercial packer.
  vmprotect
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral1 behavioral2