Extracted

• • Target
    2026-09-26_fb50eb4e801df144530dd0d7eb0bcd71_coinminer_elex_wannacry
  • Size 244KB
  • SHA256 2392ad154cf30417d3fc007d89a9189e565023610cb74c6a758069305aa52b69
  • MD5 fb50eb4e801df144530dd0d7eb0bcd71
  • SHA1 71d5aada5fc618e8c0b96fedfda40e16dc7c17ab
  • SHA512 9b242945ab45fee233068779fda9ccfa3aec760ab54d74284dda4e43a9f8e37d8a829c5c8b973de54c0a6072201e601d8e460d8d9f4b4335a9dd8893593f6eb7
  • SSDEEP 6144:eMgmYA/npA6SUqfjKfr4QdsICWkZ3h1SLCDFqnetKSoN:tgmYA/nsYf8QdsINkZ6CQetFu
  • TLSH
    T16A34E1813675CDB7F4621ABD4E2B56368136BE191B04B097D3C4AD4FF434AE5AD3E208
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoorbootkitdefense_evasiondiscoveryexecutionfarfligh0stratpersistenceratspywarestealer

  • Detects Farfli Backdoor

  • Family: Farfli

    Farfli is a Windows backdoor written in C++.

    backdoorfarfli

  • Family: Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    ratgh0strat

  • Detects executables containing base64 encoded User Agent

  • UPX dump on OEP (original entry point)

  • Deletes itself

    defense_evasion

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  behavioral1behavioral2