farfli | c80b207940230727c94fcf959b383f5c57aaaaa763b3ebacf3f882b5ed86a615

General

Target
2026-09-03_c9448bfdc0e9b42a2d5567c628f0fd55_elex_feodo_wannacry
Size 93KB
Sample260905-1day4azvdt
SHA256 c80b207940230727c94fcf959b383f5c57aaaaa763b3ebacf3f882b5ed86a615
MD5 c9448bfdc0e9b42a2d5567c628f0fd55
SHA1 b139ef663ef4239f12230426fb8f60f1f874aa06
SHA512 71cdb7506b5f8d94f95963d44489132da45c39c462f743a06c49152ad8be4dd7a6fd13907c465b2cfad4db26d55869e7155f2843a52e7f2b9add129e7366e369
SSDEEP 1536:SaK4RNx6nb4RoIw/vvBSxXsral6x2aE0zLve2yESXGTBcvt8UaKW40AEEo:xK4RNx6nb4RoIw/XBSeral6oaE0HGnvC
TLSH
T1C993AF47ABA90DD5E1204DF401AB7B36537654892B26A78BD384DE0DA43EDC0DF362CE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-09-03_c9448bfdc0e9b42a2d5567c628f0fd55_elex_feodo_wannacry
- Size 93KB
- SHA256 c80b207940230727c94fcf959b383f5c57aaaaa763b3ebacf3f882b5ed86a615
- MD5 c9448bfdc0e9b42a2d5567c628f0fd55
- SHA1 b139ef663ef4239f12230426fb8f60f1f874aa06
- SHA512 71cdb7506b5f8d94f95963d44489132da45c39c462f743a06c49152ad8be4dd7a6fd13907c465b2cfad4db26d55869e7155f2843a52e7f2b9add129e7366e369
- SSDEEP 1536:SaK4RNx6nb4RoIw/vvBSxXsral6x2aE0zLve2yESXGTBcvt8UaKW40AEEo:xK4RNx6nb4RoIw/XBSeral6oaE0HGnvC
- TLSH
  T1C993AF47ABA90DD5E1204DF401AB7B36537654892B26A78BD384DE0DA43EDC0DF362CE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor bootkit discovery execution farfli persistence spyware stealer upx
- Detects Farfli Backdoor
- Family: Farfli
  Farfli is a Windows backdoor written in C++.
  backdoor farfli
- Detects executables containing base64 encoded User Agent
- UPX dump on OEP (original entry point)
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2