Extracted

• • Target
    3db43b090711b9c21d9b86c6f229bde34b345d2acc3e6d3312b7c4b27e5bb4d5
  • Size 200KB
  • SHA256 3db43b090711b9c21d9b86c6f229bde34b345d2acc3e6d3312b7c4b27e5bb4d5
  • MD5 70adb6f7ebeb88fc853bc8f5dba7d949
  • SHA1 1ac1e60f814fef646f70a88e44a9ccc47702423d
  • SHA512 8ae475428792dafdfd919a78858a77f3fd9f1b60d9b05246bcc4485f361f57a0f4b047590f543b78bab83e9cdb5d89bd82304c1b80f47169afa732e7a3d9e2e6
  • SSDEEP 3072:fP5gvNVLIfHQja1RfmLQADwSKkhU+tLgT5lODbiC8r1PkTv:X2vnSwjaOcADw9cUeCOfx
  • TLSH
    T1E1141200CBB4A1E4D49934BA0BC3A311E7F2DECDBB735BB192D6922FAF41F166459490
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoorbootkitdiscoveryexecutionfarfligh0stratpersistenceratspywarestealer

  • Detects Farfli Backdoor

  • Family: Farfli

    Farfli is a Windows backdoor written in C++.

    backdoorfarfli

  • Family: Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    ratgh0strat

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  behavioral1behavioral2