farfli | afe3066b09100e1e8e019166754ecc29a9be08d1eccb49fa607b411a7f68c02b

General

Target
2026-07-06_ac244a844fb964637aad05d317500b5e_elex_wannacry
Size 93KB
Sample260707-b2z6fsft8y
SHA256 afe3066b09100e1e8e019166754ecc29a9be08d1eccb49fa607b411a7f68c02b
MD5 ac244a844fb964637aad05d317500b5e
SHA1 ead6c37975e77b999869871f0da169100f20129e
SHA512 ee5bf2b41f9910b6b75c74d6f951ee10fdde42bd29b7cf5e50e6ec0a170d9c8f1fa5c6813c00be346053feaffc1a25db51d98e55f8b3729e5c2189f9c70d934f
SSDEEP 1536:8gDktLw4rO10tMrlk3SJDlf98jqP+8il3CxOeZIckWlmyp6/:uLRrO10TiJD9yjqrilyxOuPp6/
TLSH
T16E93BF1DBD93886ED0058B3147579715E6B2AC59F9314F334350FA1DAF3290BEEDA288
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-06_ac244a844fb964637aad05d317500b5e_elex_wannacry
- Size 93KB
- SHA256 afe3066b09100e1e8e019166754ecc29a9be08d1eccb49fa607b411a7f68c02b
- MD5 ac244a844fb964637aad05d317500b5e
- SHA1 ead6c37975e77b999869871f0da169100f20129e
- SHA512 ee5bf2b41f9910b6b75c74d6f951ee10fdde42bd29b7cf5e50e6ec0a170d9c8f1fa5c6813c00be346053feaffc1a25db51d98e55f8b3729e5c2189f9c70d934f
- SSDEEP 1536:8gDktLw4rO10tMrlk3SJDlf98jqP+8il3CxOeZIckWlmyp6/:uLRrO10TiJD9yjqrilyxOuPp6/
- TLSH
  T16E93BF1DBD93886ED0058B3147579715E6B2AC59F9314F334350FA1DAF3290BEEDA288
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor bootkit discovery farfli persistence spyware stealer adware
- Detects Farfli Backdoor
- Family: Farfli
  Farfli is a Windows backdoor written in C++.
  backdoor farfli
- Detects executables containing base64 encoded User Agent
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral1 behavioral2