Extracted

• • Target
    9a24ee4db980933371e939623b1235a75dbda5f81b262f0f270aa046fab97373
  • Size 597KB
  • SHA256 9a24ee4db980933371e939623b1235a75dbda5f81b262f0f270aa046fab97373
  • MD5 3ed3d33e6f50dd0b370e20c676b64611
  • SHA1 dddec19195f717d66a84fab3b8c38bbdaf5d5f11
  • SHA512 ef8b6297d6f2f20290bd3e24616b9889a3a50336ff8c53a6b1e9b63498c8bb54c68d0955760fb075569fc2e3bca73a099d61f8be52d46c5d6f8a4a1e0b859231
  • SSDEEP 6144:XP5fpE05D7AQNCO7AAtq2xc9QeAmh/9+xeayem:XPZpE0V9NB9PxchAmV9is
  • TLSH
    T196D4123C3AE35D5DEA5B4F71068F94E02A29F9D17AF0C70B85AC40BEF85B1917849AC0
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoorbootkitdiscoveryexecutionfarfligh0stratpersistenceratspywarestealer

  • Detects Farfli Backdoor

  • Family: Farfli

    Farfli is a Windows backdoor written in C++.

    backdoorfarfli

  • Family: Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    ratgh0strat

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  behavioral1