farfli | 4509b9954bd9534388b9304ec1876a9db013ccbb57bd38d4d7c026299c094fc3

General

Target
4509b9954bd9534388b9304ec1876a9db013ccbb57bd38d4d7c026299c094fc3
Size 101KB
Sample260826-lhxlbss1cs
SHA256 4509b9954bd9534388b9304ec1876a9db013ccbb57bd38d4d7c026299c094fc3
MD5 b307f76a53a13a616242e04e5102c065
SHA1 aba9f6323edf187dbee65627415cd5fc09753795
SHA512 da1aa0eb1725739bfbe2f8f829d8c1636bd3d7d0efff4a4390f7028abc1f10538bd919558a27880cf06b39ea766f31769ddc8dc5873d41f22d4e6e0cdaded66d
SSDEEP 1536:p8WwLyxxaYcSedHCm87M9MmnMEefRSgUYjMM+chuoH0+uCqS6RGJK2d7E6O/:/wmxagedESM6opSgDMM8WYxGA6O/
TLSH
T1BDA312FB1DB43E17C06B6D32DD569F6D810690EA0DA9891BBF8E20A36DF61C871C4B40
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  4509b9954bd9534388b9304ec1876a9db013ccbb57bd38d4d7c026299c094fc3
- Size 101KB
- SHA256 4509b9954bd9534388b9304ec1876a9db013ccbb57bd38d4d7c026299c094fc3
- MD5 b307f76a53a13a616242e04e5102c065
- SHA1 aba9f6323edf187dbee65627415cd5fc09753795
- SHA512 da1aa0eb1725739bfbe2f8f829d8c1636bd3d7d0efff4a4390f7028abc1f10538bd919558a27880cf06b39ea766f31769ddc8dc5873d41f22d4e6e0cdaded66d
- SSDEEP 1536:p8WwLyxxaYcSedHCm87M9MmnMEefRSgUYjMM+chuoH0+uCqS6RGJK2d7E6O/:/wmxagedESM6opSgDMM8WYxGA6O/
- TLSH
  T1BDA312FB1DB43E17C06B6D32DD569F6D810690EA0DA9891BBF8E20A36DF61C871C4B40
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor bootkit discovery farfli persistence spyware stealer upx
- Detects Farfli Backdoor
- Family: Farfli
  Farfli is a Windows backdoor written in C++.
  backdoor farfli
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1