farfli | d95093c2af9cac47bc35aa7b8fc754fd40a3e3b6209d71ef2c50606ca57c2740

General

Target
2026-09-09_31c65ba9e928a8b5bb7b974c8bac5b33_elex_wannacry
Size 119KB
Sample260909-128v2attc1
SHA256 d95093c2af9cac47bc35aa7b8fc754fd40a3e3b6209d71ef2c50606ca57c2740
MD5 31c65ba9e928a8b5bb7b974c8bac5b33
SHA1 5afaaf65395908954641a169707def833c55327d
SHA512 717ef431c5b02b75fc0791ca84bdf46ed3f8882209e6b15448411ae6609903f4d1e58b2bf8e75cf58dc702d55ba7b6a3abe9b704e256bb831c9a04fafe322b09
SSDEEP 3072:xK4RNx6nb4RoIw/XBSeral6oaE0HGnvXuEOrc0py+:xl6XYeel6GGGVO8+
TLSH
T16FC39F479BA58DD5E0111CF502ABBB3583B6988D3B15A757C388DE0EE03DE84DB362C9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-09-09_31c65ba9e928a8b5bb7b974c8bac5b33_elex_wannacry
- Size 119KB
- SHA256 d95093c2af9cac47bc35aa7b8fc754fd40a3e3b6209d71ef2c50606ca57c2740
- MD5 31c65ba9e928a8b5bb7b974c8bac5b33
- SHA1 5afaaf65395908954641a169707def833c55327d
- SHA512 717ef431c5b02b75fc0791ca84bdf46ed3f8882209e6b15448411ae6609903f4d1e58b2bf8e75cf58dc702d55ba7b6a3abe9b704e256bb831c9a04fafe322b09
- SSDEEP 3072:xK4RNx6nb4RoIw/XBSeral6oaE0HGnvXuEOrc0py+:xl6XYeel6GGGVO8+
- TLSH
  T16FC39F479BA58DD5E0111CF502ABBB3583B6988D3B15A757C388DE0EE03DE84DB362C9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor bootkit discovery execution farfli persistence spyware stealer upx
- Detects Farfli Backdoor
- Family: Farfli
  Farfli is a Windows backdoor written in C++.
  backdoor farfli
- Detects executables containing base64 encoded User Agent
- UPX dump on OEP (original entry point)
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2