farfli | de9a660e54d27ae89750b6bc2d206ba5d203bc4016c0dbf9c326d81689489ab6

General

Target
2026-06-04_0603669373a952df1afd1284cb627112_elex_wannacry
Size 94KB
Sample260604-kcrbpacv6r
SHA256 de9a660e54d27ae89750b6bc2d206ba5d203bc4016c0dbf9c326d81689489ab6
MD5 0603669373a952df1afd1284cb627112
SHA1 c6fc18493e97b35e04dc55ca41fc929b8f9d092a
SHA512 2e45e489794216e788d323770f603651c42b299eab9a6918b664c63b6266f54cde3f5466e09f1af95fc337e4bf1aed5d1ccc09c6e1ecf317018816a3f38ccb50
SSDEEP 1536:TSSABNx6vb4RoI47zzzzzzzzzvfxzVzNrzzzgzzzzzzzzzzzzzzzz6zzzdzzzzlB:eSABNx6vb4RoI4pyjHYLhal01UoPX+h0
TLSH
T18593AE17ABA589C9F1217C30566E373187BF985D3F1457679348EE4EA833D80EC3628A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-06-04_0603669373a952df1afd1284cb627112_elex_wannacry
- Size 94KB
- SHA256 de9a660e54d27ae89750b6bc2d206ba5d203bc4016c0dbf9c326d81689489ab6
- MD5 0603669373a952df1afd1284cb627112
- SHA1 c6fc18493e97b35e04dc55ca41fc929b8f9d092a
- SHA512 2e45e489794216e788d323770f603651c42b299eab9a6918b664c63b6266f54cde3f5466e09f1af95fc337e4bf1aed5d1ccc09c6e1ecf317018816a3f38ccb50
- SSDEEP 1536:TSSABNx6vb4RoI47zzzzzzzzzvfxzVzNrzzzgzzzzzzzzzzzzzzzz6zzzdzzzzlB:eSABNx6vb4RoI4pyjHYLhal01UoPX+h0
- TLSH
  T18593AE17ABA589C9F1217C30566E373187BF985D3F1457679348EE4EA833D80EC3628A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor bootkit discovery farfli persistence spyware stealer
- Detects Farfli Backdoor
- Family: Farfli
  Farfli is a Windows backdoor written in C++.
  backdoor farfli
- Detects executables containing base64 encoded User Agent
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral1 behavioral2