farfli | 694f63a59e8922d6bfc52900e1e962f6ab4f5a9703719f2190b0056f9696c4bc

General

Target
2026-09-04_ae832c8d95714401e91607dd6510fa22_elex_wannacry
Size 142KB
Sample260905-apkdsscj6x
SHA256 694f63a59e8922d6bfc52900e1e962f6ab4f5a9703719f2190b0056f9696c4bc
MD5 ae832c8d95714401e91607dd6510fa22
SHA1 9bcee860692704d88c4d7479879b6759ad2958be
SHA512 8e8b015f600bb725076d19951f16c5ea9416436b2554d0dfea8c1a36faae0c0d58efa58ad3467e68b76e14b483fc0ac02f10b6929d410b4a539ef8ec84a0e8cc
SSDEEP 1536:f/6EkrKHqgGFs5N6s7H3dPT+X/O3DX6HZ9am1AEgHZ5bdpDvkDBlxZP1nd:fSKP3Pe/Oz67aKVgbbdpDcljZ9nd
TLSH
T1AAE3AE527A61C5F0E016553313879B3186B1EC5E3A1813FE93C8EB4FB954B25ECBB1A8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-09-04_ae832c8d95714401e91607dd6510fa22_elex_wannacry
- Size 142KB
- SHA256 694f63a59e8922d6bfc52900e1e962f6ab4f5a9703719f2190b0056f9696c4bc
- MD5 ae832c8d95714401e91607dd6510fa22
- SHA1 9bcee860692704d88c4d7479879b6759ad2958be
- SHA512 8e8b015f600bb725076d19951f16c5ea9416436b2554d0dfea8c1a36faae0c0d58efa58ad3467e68b76e14b483fc0ac02f10b6929d410b4a539ef8ec84a0e8cc
- SSDEEP 1536:f/6EkrKHqgGFs5N6s7H3dPT+X/O3DX6HZ9am1AEgHZ5bdpDvkDBlxZP1nd:fSKP3Pe/Oz67aKVgbbdpDcljZ9nd
- TLSH
  T1AAE3AE527A61C5F0E016553313879B3186B1EC5E3A1813FE93C8EB4FB954B25ECBB1A8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor bootkit discovery execution farfli persistence spyware stealer upx
- Detects Farfli Backdoor
- Family: Farfli
  Farfli is a Windows backdoor written in C++.
  backdoor farfli
- Custom signature
  
  Detects executables containing base64 encoded User Agent
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2