Extracted

• • Target
    7c01a56713031318ba0d2d6a7dd57501529f27ed6712357aa9cce2378476cd6b
  • Size 596KB
  • SHA256 7c01a56713031318ba0d2d6a7dd57501529f27ed6712357aa9cce2378476cd6b
  • MD5 8da19f680b8d434d11e0be11ce21e4ea
  • SHA1 b9bce326e74bfdff8c71e450e98029361a6012fc
  • SHA512 ea08a1bd0ae733e02ef3e3910908acc2ab06f431a159147d6beb73443ad86ffaa2c8586ccfb2b23b9b26477c2c943e38bc4b926f022277772bd6f439162d01d6
  • SSDEEP 6144:XP5fpE05D7AQNCO7AAtq2xc9QeAmh/9+xeayeg:XPZpE0V9NB9PxchAmV9iG
  • TLSH
    T109D4123C36E35D5DEA5B0F71068F84E06A69F9D17AF0C70B85AC40BEF85B1907849AC1
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoorbootkitdiscoveryexecutionfarfligh0stratpersistenceratspywarestealer

  • Detects Farfli Backdoor

  • Family: Farfli

    Farfli is a Windows backdoor written in C++.

    backdoorfarfli

  • Family: Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    ratgh0strat

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  behavioral1