farfli | f87fe1250f08f79b6a3ff8471680cee907efc092efa5caa4a0d9acebe88d2a8b

General

Target
2026-10-28_4657dfaeac707409d1411fe08a42267e_elex_wannacry
Size 143KB
Sample261028-plgk3act3y
SHA256 f87fe1250f08f79b6a3ff8471680cee907efc092efa5caa4a0d9acebe88d2a8b
MD5 4657dfaeac707409d1411fe08a42267e
SHA1 f1c8f14151e7a18e64bab4d09653629f5767e167
SHA512 31a3a2ffcbf01cb37e14b599808b9777715018ae464c41f4de1f0ce272497ae24be17ab6767ad601f6a0da1b626f10f25f83b1324de171339f309fa6c190286d
SSDEEP 1536:f/6EkrKHqgGFs5N6s7H3dPT+X/O3DX6HZ9am1AEgHZ5bdpDvkDBlxZP1n3:fSKP3Pe/Oz67aKVgbbdpDcljZ9n3
TLSH
T10EE39E527A60C5F0E01655335387AB3186B1DC5E3A1813FE93C8EB0FBD55B25ACBB1A8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-10-28_4657dfaeac707409d1411fe08a42267e_elex_wannacry
- Size 143KB
- SHA256 f87fe1250f08f79b6a3ff8471680cee907efc092efa5caa4a0d9acebe88d2a8b
- MD5 4657dfaeac707409d1411fe08a42267e
- SHA1 f1c8f14151e7a18e64bab4d09653629f5767e167
- SHA512 31a3a2ffcbf01cb37e14b599808b9777715018ae464c41f4de1f0ce272497ae24be17ab6767ad601f6a0da1b626f10f25f83b1324de171339f309fa6c190286d
- SSDEEP 1536:f/6EkrKHqgGFs5N6s7H3dPT+X/O3DX6HZ9am1AEgHZ5bdpDvkDBlxZP1n3:fSKP3Pe/Oz67aKVgbbdpDcljZ9n3
- TLSH
  T10EE39E527A60C5F0E01655335387AB3186B1DC5E3A1813FE93C8EB0FBD55B25ACBB1A8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor bootkit defense_evasion discovery execution farfli persistence spyware stealer upx
- Detects Farfli Backdoor
- Family: Farfli
  Farfli is a Windows backdoor written in C++.
  backdoor farfli
- Detects executables containing base64 encoded User Agent
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Deletes itself
  defense_evasion
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2