farfli | 6d43f0005d9a7b4ef8986c9125e55478f69b30daafbbefcb3097330e7e871606

General

Target
2026-08-15_c092252150d34e175a9252649a4395ab_coinminer_elex_wannacry
Size 150KB
Sample260816-aacemsaj41
SHA256 6d43f0005d9a7b4ef8986c9125e55478f69b30daafbbefcb3097330e7e871606
MD5 c092252150d34e175a9252649a4395ab
SHA1 13f80b3ae356e167e36c8d80e33c14c9a0fcfe6a
SHA512 b001a41791210adf80a5855e2ca0e26976bf55bfb8bd97d4be7c5a246a0846189de42570e1be0a50542f65a77260b02e8229d4810b2c911e31c1ae5d9fb4b6a8
SSDEEP 1536:B3aacz2htqkUla/NGVcJ/gAqcX0JMseuiGSeNVvDi0tMuUJJny3GM+9qKvL:Ua/qc9rqzMseNoVv9EJFnM8qKvL
TLSH
T1DEE3270267F6C198F0B31E30DA3646F08BA6BC69FA70921B17447E4EBD31A15ED21776
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-15_c092252150d34e175a9252649a4395ab_coinminer_elex_wannacry
- Size 150KB
- SHA256 6d43f0005d9a7b4ef8986c9125e55478f69b30daafbbefcb3097330e7e871606
- MD5 c092252150d34e175a9252649a4395ab
- SHA1 13f80b3ae356e167e36c8d80e33c14c9a0fcfe6a
- SHA512 b001a41791210adf80a5855e2ca0e26976bf55bfb8bd97d4be7c5a246a0846189de42570e1be0a50542f65a77260b02e8229d4810b2c911e31c1ae5d9fb4b6a8
- SSDEEP 1536:B3aacz2htqkUla/NGVcJ/gAqcX0JMseuiGSeNVvDi0tMuUJJny3GM+9qKvL:Ua/qc9rqzMseNoVv9EJFnM8qKvL
- TLSH
  T1DEE3270267F6C198F0B31E30DA3646F08BA6BC69FA70921B17447E4EBD31A15ED21776
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor bootkit discovery execution farfli persistence spyware stealer upx
- Detects Farfli Backdoor
- Family: Farfli
  Farfli is a Windows backdoor written in C++.
  backdoor farfli
- Detects executables containing base64 encoded User Agent
- UPX dump on OEP (original entry point)
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2