farfli | efcd730511f28822690f6c37e7ca60f9a1007efb1623d805d018f37fca82f778

General

Target
2026-09-24_0bd1c4552b538c7917f711b27017f16b_elex_wannacry
Size 217KB
Sample260925-snretsvvdt
SHA256 efcd730511f28822690f6c37e7ca60f9a1007efb1623d805d018f37fca82f778
MD5 0bd1c4552b538c7917f711b27017f16b
SHA1 a331c65af4d1f332bc2e895618a5aab9b9a23706
SHA512 259e0d14091bced8ee99c1ee5ac69264855e2b9bf5fc6c7f6198e36d70e1c778022018b70fa430eb8fa1b3f8a51667eba49437820fef8bf010e75ff0288f6589
SSDEEP 3072:TfwwHEzrV5x5tMBql0RZ4FjCDnO8XjDDQuMHNbwDXkLh16oVHeb:zwgErtcql+ZHn1PDQfwDXkN1Z+
TLSH
T17324F11B369189AFF00BFB769746F0C78BD1A4283F40772E038C699E5B217CAC59616D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-09-24_0bd1c4552b538c7917f711b27017f16b_elex_wannacry
- Size 217KB
- SHA256 efcd730511f28822690f6c37e7ca60f9a1007efb1623d805d018f37fca82f778
- MD5 0bd1c4552b538c7917f711b27017f16b
- SHA1 a331c65af4d1f332bc2e895618a5aab9b9a23706
- SHA512 259e0d14091bced8ee99c1ee5ac69264855e2b9bf5fc6c7f6198e36d70e1c778022018b70fa430eb8fa1b3f8a51667eba49437820fef8bf010e75ff0288f6589
- SSDEEP 3072:TfwwHEzrV5x5tMBql0RZ4FjCDnO8XjDDQuMHNbwDXkLh16oVHeb:zwgErtcql+ZHn1PDQfwDXkN1Z+
- TLSH
  T17324F11B369189AFF00BFB769746F0C78BD1A4283F40772E038C699E5B217CAC59616D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor bootkit defense_evasion discovery execution farfli persistence spyware stealer
- Detects Farfli Backdoor
- Family: Farfli
  Farfli is a Windows backdoor written in C++.
  backdoor farfli
- Detects executables containing base64 encoded User Agent
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Deletes itself
  defense_evasion
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Suspicious use of NtSetInformationThreadHideFromDebugger
  defense_evasion
behavioral1 behavioral2