farfli | 03c8904e2008e0e33a04ffe55f4208b4d25565ac45ca8094706f8dc674bc8cc6

General

Target
2026-06-29_67a625858d8b8cd6a65f0e14e69ef534_elex_wannacry
Size 403KB
Sample260630-kkgr8aaz7t
SHA256 03c8904e2008e0e33a04ffe55f4208b4d25565ac45ca8094706f8dc674bc8cc6
MD5 67a625858d8b8cd6a65f0e14e69ef534
SHA1 264f5febb9da6188a4a1739855fa7ec568f99aca
SHA512 ec1108ae97b22da93bca6284f877176621676774a41c51ad4f5a2be713907cc4f1a9028be26362826bf07c39012f042d00f2509efaaa6ab94c5892467eadf86c
SSDEEP 6144:WtecHBTStjVfs3mCL17O/cvARZZWcStoWwABr8iXpXxr2kDQH6Lz:oHBTAjBqbYkvqZMcV7i32iTf
TLSH
T1D594DF2332C0C8B7D1D13373FEE6AA72E3F5C2A85D396A7753DA014D5E2744C92162A9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-06-29_67a625858d8b8cd6a65f0e14e69ef534_elex_wannacry
- Size 403KB
- SHA256 03c8904e2008e0e33a04ffe55f4208b4d25565ac45ca8094706f8dc674bc8cc6
- MD5 67a625858d8b8cd6a65f0e14e69ef534
- SHA1 264f5febb9da6188a4a1739855fa7ec568f99aca
- SHA512 ec1108ae97b22da93bca6284f877176621676774a41c51ad4f5a2be713907cc4f1a9028be26362826bf07c39012f042d00f2509efaaa6ab94c5892467eadf86c
- SSDEEP 6144:WtecHBTStjVfs3mCL17O/cvARZZWcStoWwABr8iXpXxr2kDQH6Lz:oHBTAjBqbYkvqZMcV7i32iTf
- TLSH
  T1D594DF2332C0C8B7D1D13373FEE6AA72E3F5C2A85D396A7753DA014D5E2744C92162A9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor bootkit discovery farfli persistence spyware stealer upx adware
- Detects Farfli Backdoor
- Family: Farfli
  Farfli is a Windows backdoor written in C++.
  backdoor farfli
- Custom signature
  
  Detects executables containing base64 encoded User Agent
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2