farfli | 27ef4e0322f765bacf47d1514d0bde5f2afa6b76d44c3e3a0bc1e873ee031496

General

Target
2026-07-05_276fbde7e1a3364cd402ccc8bb3fd021_elex_wannacry
Size 96KB
Sample260705-tr2weahw6k
SHA256 27ef4e0322f765bacf47d1514d0bde5f2afa6b76d44c3e3a0bc1e873ee031496
MD5 276fbde7e1a3364cd402ccc8bb3fd021
SHA1 d764009783c8107eeef898764e947160df4a812e
SHA512 822ce8b29f58b4fa06bb6d9aba3fcbbc5ca28d70d5f0c742a8d5e870d007c112d2b7887b8a4fb81dab8753d6aec5a5ef5de24f8d12270eed4bc36a33763cb318
SSDEEP 3072:eSABNx6vb4RoI4pyjHYLhal01UoPX+hwo6g:el69Ml0TE1
TLSH
T1BDA3AE17ABA589C9F1216C30562E773087BFA85D3F1457639348EE4EE437D81EC3628A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-05_276fbde7e1a3364cd402ccc8bb3fd021_elex_wannacry
- Size 96KB
- SHA256 27ef4e0322f765bacf47d1514d0bde5f2afa6b76d44c3e3a0bc1e873ee031496
- MD5 276fbde7e1a3364cd402ccc8bb3fd021
- SHA1 d764009783c8107eeef898764e947160df4a812e
- SHA512 822ce8b29f58b4fa06bb6d9aba3fcbbc5ca28d70d5f0c742a8d5e870d007c112d2b7887b8a4fb81dab8753d6aec5a5ef5de24f8d12270eed4bc36a33763cb318
- SSDEEP 3072:eSABNx6vb4RoI4pyjHYLhal01UoPX+hwo6g:el69Ml0TE1
- TLSH
  T1BDA3AE17ABA589C9F1216C30562E773087BFA85D3F1457639348EE4EE437D81EC3628A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor bootkit discovery farfli persistence spyware stealer adware ransomware
- Detects Farfli Backdoor
- Family: Farfli
  Farfli is a Windows backdoor written in C++.
  backdoor farfli
- Detects executables containing base64 encoded User Agent
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral1 behavioral2