farfli | 19f284912fe0e39f25946edb50d037642d4947230d7ff661955264d67619061c

General

Target
2026-09-30_497c276e84de058e4945827e49460390_elex_wannacry
Size 127KB
Sample260930-nvvnlsec86
SHA256 19f284912fe0e39f25946edb50d037642d4947230d7ff661955264d67619061c
MD5 497c276e84de058e4945827e49460390
SHA1 5bb4ec43608642c39550c292f47886e3de7c58a2
SHA512 dbaaf93e7e2c09ca671991f92fe5503eab21ac0024ea0d6161c8b142d436adbec0234935fe982ce08e9723b28097fbf47640a0ed599805cdf620b5d241c4bdd3
SSDEEP 3072:xK4RNx6nb4RoIw/XBSeral6oaE0HGnvXuEOrc0pg:xl6XYeel6GGGVOS
TLSH
T1BCD38D429BB189E5E0111CF8035BBB3483B6988D3B15A763D388DE0EE42DE85DF361D9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-09-30_497c276e84de058e4945827e49460390_elex_wannacry
- Size 127KB
- SHA256 19f284912fe0e39f25946edb50d037642d4947230d7ff661955264d67619061c
- MD5 497c276e84de058e4945827e49460390
- SHA1 5bb4ec43608642c39550c292f47886e3de7c58a2
- SHA512 dbaaf93e7e2c09ca671991f92fe5503eab21ac0024ea0d6161c8b142d436adbec0234935fe982ce08e9723b28097fbf47640a0ed599805cdf620b5d241c4bdd3
- SSDEEP 3072:xK4RNx6nb4RoIw/XBSeral6oaE0HGnvXuEOrc0pg:xl6XYeel6GGGVOS
- TLSH
  T1BCD38D429BB189E5E0111CF8035BBB3483B6988D3B15A763D388DE0EE42DE85DF361D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor bootkit defense_evasion discovery execution farfli persistence spyware stealer upx
- Detects Farfli Backdoor
- Family: Farfli
  Farfli is a Windows backdoor written in C++.
  backdoor farfli
- Detects executables containing base64 encoded User Agent
- UPX dump on OEP (original entry point)
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Deletes itself
  defense_evasion
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2