farfli | f7f363e00e59f1a1fe1c763efcc936da7d857a80b23dec4c0265c8b7b4feaa63

General

Target
2026-08-15_d6523bf50995e43d1407ff492d39a31c_coinminer_elex_wannacry
Size 171KB
Sample260815-fyccfafk5w
SHA256 f7f363e00e59f1a1fe1c763efcc936da7d857a80b23dec4c0265c8b7b4feaa63
MD5 d6523bf50995e43d1407ff492d39a31c
SHA1 a181635203a4544ae83028fe08da71cce8929ecd
SHA512 5d814f521788880c7c1227688f40b11aff727fe408ba581ee18048d1f7efb649ba231bf09c3993ea15dc49bb627332c5c5a34d2e2ccaf06638ed7eed51755403
SSDEEP 3072:h1qLbqRhEAZqR29I5pmHr8/iOwkZ4YHvpzerWA0luLUqVJ:h0AZ42S5pp/dWYHBAWd+v
TLSH
T18D04E101A759925AD733083F0727527DA6BDBD344B1C75D3A7C86A2E9138FE0AA3121F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-15_d6523bf50995e43d1407ff492d39a31c_coinminer_elex_wannacry
- Size 171KB
- SHA256 f7f363e00e59f1a1fe1c763efcc936da7d857a80b23dec4c0265c8b7b4feaa63
- MD5 d6523bf50995e43d1407ff492d39a31c
- SHA1 a181635203a4544ae83028fe08da71cce8929ecd
- SHA512 5d814f521788880c7c1227688f40b11aff727fe408ba581ee18048d1f7efb649ba231bf09c3993ea15dc49bb627332c5c5a34d2e2ccaf06638ed7eed51755403
- SSDEEP 3072:h1qLbqRhEAZqR29I5pmHr8/iOwkZ4YHvpzerWA0luLUqVJ:h0AZ42S5pp/dWYHBAWd+v
- TLSH
  T18D04E101A759925AD733083F0727527DA6BDBD344B1C75D3A7C86A2E9138FE0AA3121F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor bootkit discovery execution farfli persistence spyware stealer upx
- Detects Farfli Backdoor
- Family: Farfli
  Farfli is a Windows backdoor written in C++.
  backdoor farfli
- Detects executables containing base64 encoded User Agent
- Detects executables packed with VMProtect.
- UPX dump on OEP (original entry point)
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2