Extracted

• • Target
    ff5f1d4a635c365a5020e7b732e273976b73f4e160489a1f4fdf02a813ab7e90
  • Size 231KB
  • SHA256 ff5f1d4a635c365a5020e7b732e273976b73f4e160489a1f4fdf02a813ab7e90
  • MD5 07d02e971f34f9bc417bfd81ad1b27a0
  • SHA1 b2e515b1841d5b406a1ec85361f7c384f7743f94
  • SHA512 51cfba9b0fd35f27e8752d2b1ca8c2173368d5f49785fcb19bece7faeb2c5b5958feba8eafbba0fb619e5d389134bb342d417a5a3c9036288a8c3417b8ca073f
  • SSDEEP 3072:fP5gvNVLIfHQja1RfmLQADwSKkhU+tLgT5lODbiC8r1PkTFN:X2vnSwjaOcADw9cUeCOfN
  • TLSH
    T1D2340200DBB2F5E8D44824BA0787D310E7E1DC9E7B73677143D5E22FAB41F1AA4AA194
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoorbootkitdiscoveryexecutionfarfligh0stratpersistenceratspywarestealer

  • Detects Farfli Backdoor

  • Family: Farfli

    Farfli is a Windows backdoor written in C++.

    backdoorfarfli

  • Family: Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    ratgh0strat

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  behavioral1behavioral2