farfli | c8e206c60d4674553663565adc199c9c407e055849edf2f452e22caf5949a267

General

Target
2026-09-04_945fed30079cd0e58db6c49c5a6c3ac4_elex_wannacry
Size 139KB
Sample260905-dmhc7sbf26
SHA256 c8e206c60d4674553663565adc199c9c407e055849edf2f452e22caf5949a267
MD5 945fed30079cd0e58db6c49c5a6c3ac4
SHA1 0ce2739ba0285aee9ff57dd5acf94c20aa31da14
SHA512 3bdc452431b379c9c67b87631a01faf08b847dc96cda88a1738767453899ea8084280b76f656b969e04b0bd738f07c226d81bd519113a9071dfc696365de7a85
SSDEEP 1536:f/6EkrKHqgGFs5N6s7H3dPT+X/O3DX6HZ9am1AEgHZ5bdpDvkDBlxZP1n:fSKP3Pe/Oz67aKVgbbdpDcljZ9n
TLSH
T1FED3AF527A6185F0E01645331397AB318671DC5E3A1813FE93C8EB0FBD65B25ECBB198
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-09-04_945fed30079cd0e58db6c49c5a6c3ac4_elex_wannacry
- Size 139KB
- SHA256 c8e206c60d4674553663565adc199c9c407e055849edf2f452e22caf5949a267
- MD5 945fed30079cd0e58db6c49c5a6c3ac4
- SHA1 0ce2739ba0285aee9ff57dd5acf94c20aa31da14
- SHA512 3bdc452431b379c9c67b87631a01faf08b847dc96cda88a1738767453899ea8084280b76f656b969e04b0bd738f07c226d81bd519113a9071dfc696365de7a85
- SSDEEP 1536:f/6EkrKHqgGFs5N6s7H3dPT+X/O3DX6HZ9am1AEgHZ5bdpDvkDBlxZP1n:fSKP3Pe/Oz67aKVgbbdpDcljZ9n
- TLSH
  T1FED3AF527A6185F0E01645331397AB318671DC5E3A1813FE93C8EB0FBD65B25ECBB198
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor bootkit discovery execution farfli persistence spyware stealer upx
- Detects Farfli Backdoor
- Family: Farfli
  Farfli is a Windows backdoor written in C++.
  backdoor farfli
- Detects executables containing base64 encoded User Agent
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2