Extracted

• • Target
    624671f65f88ef65b0e392a14c6efe8f065ad38d0ad7f03a1b16b7bc7958ba80
  • Size 179KB
  • SHA256 624671f65f88ef65b0e392a14c6efe8f065ad38d0ad7f03a1b16b7bc7958ba80
  • MD5 a7d23429b5c2c9426ded46781d51cf12
  • SHA1 44c43acb0502b4046b54be7b067a572fa31ef924
  • SHA512 86e3f0825fd7246cdfaefd090463462e778e547e69df53f4a713550c9bb5e57c0a2c2825a50d3f617a637b15de1f45df2ff20aba1fb581d76d14d8a5198ab324
  • SSDEEP 3072:EC5Wpfs98nVCWdKycHtld8VBt7NUalwXH9RqYzJabTYd3KIdj6+uFdi98pvO0hfc:ECOfQ8nVcycHrd8VBtBUa4HfRzJabT8z
  • TLSH
    T1560423EABF82C652C84F677676AF244437AD05D91BC1E0A56F0482CE39C3135E67DE48
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoorbootkitdiscoveryfarfligh0stratpersistenceratspywarestealer

  • Detects Farfli Backdoor

  • Family: Farfli

    Farfli is a Windows backdoor written in C++.

    backdoorfarfli

  • Family: Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    ratgh0strat

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  behavioral1