farfli | dc43a84c2de42c809e7fae8866da411a57e852ce31dc0e2e8b63bcd95cd03bfc

General

Target
2026-06-25_d26cc7ab9326d30ef0219611eea37045_elex_wannacry
Size 112KB
Sample260629-yd9rbaez2m
SHA256 dc43a84c2de42c809e7fae8866da411a57e852ce31dc0e2e8b63bcd95cd03bfc
MD5 d26cc7ab9326d30ef0219611eea37045
SHA1 c38f145687827a1ccf82e04622d28ac2979c1afd
SHA512 e276c1d41f727629e69b86461b60288f3a7737c50292708e26cf1d6942c6b18c4d41a4d271a08cea55e40ea2c7b04afeb117a11df130a88d9bda793490ff5a8a
SSDEEP 1536:agDktLw4rO10tMrlk3SJDlf98jqP+8il3CxOeZIcIWlmyyFZ:ELRrO10TiJD9yjqrilyxOWPyf
TLSH
T117B3AD5D6D62C49EE4014B7043579721A6A2AC5DFA304F334380BA4EFF36E0BEDE9198
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-06-25_d26cc7ab9326d30ef0219611eea37045_elex_wannacry
- Size 112KB
- SHA256 dc43a84c2de42c809e7fae8866da411a57e852ce31dc0e2e8b63bcd95cd03bfc
- MD5 d26cc7ab9326d30ef0219611eea37045
- SHA1 c38f145687827a1ccf82e04622d28ac2979c1afd
- SHA512 e276c1d41f727629e69b86461b60288f3a7737c50292708e26cf1d6942c6b18c4d41a4d271a08cea55e40ea2c7b04afeb117a11df130a88d9bda793490ff5a8a
- SSDEEP 1536:agDktLw4rO10tMrlk3SJDlf98jqP+8il3CxOeZIcIWlmyyFZ:ELRrO10TiJD9yjqrilyxOWPyf
- TLSH
  T117B3AD5D6D62C49EE4014B7043579721A6A2AC5DFA304F334380BA4EFF36E0BEDE9198
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor bootkit discovery farfli persistence spyware stealer adware
- Detects Farfli Backdoor
- Family: Farfli
  Farfli is a Windows backdoor written in C++.
  backdoor farfli
- Detects executables containing base64 encoded User Agent
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral1 behavioral2