farfli | b640a82080ab32a4043f7f0117c0cfc103d3c6213e4c22aebeeb8b4a4e79b26a

General

Target
2026-10-28_ed4428a63a987d4ebb5c2e9833823ba8_elex_wannacry
Size 225KB
Sample261029-denv1saa93
SHA256 b640a82080ab32a4043f7f0117c0cfc103d3c6213e4c22aebeeb8b4a4e79b26a
MD5 ed4428a63a987d4ebb5c2e9833823ba8
SHA1 9ed94aee7b0f71b8cebed82c9706ced83fb713ec
SHA512 8b12e5c0b54f124ab2f5f10e095c9f800aa6ec84518fd31f7018246a7e68874a904296dda0b67f7831c454782be5381da0097429cee0c3ae815cd5f0df167682
SSDEEP 6144:LMPTxAnyi9awI2WXyZPbwdpLr7FQXSzKD:4PTPjnCCdpOh
TLSH
T11634E011D692C1D9D07247F64E3BC53ADC1AAE261F0865C333867B6AA475EE0AF7102F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-10-28_ed4428a63a987d4ebb5c2e9833823ba8_elex_wannacry
- Size 225KB
- SHA256 b640a82080ab32a4043f7f0117c0cfc103d3c6213e4c22aebeeb8b4a4e79b26a
- MD5 ed4428a63a987d4ebb5c2e9833823ba8
- SHA1 9ed94aee7b0f71b8cebed82c9706ced83fb713ec
- SHA512 8b12e5c0b54f124ab2f5f10e095c9f800aa6ec84518fd31f7018246a7e68874a904296dda0b67f7831c454782be5381da0097429cee0c3ae815cd5f0df167682
- SSDEEP 6144:LMPTxAnyi9awI2WXyZPbwdpLr7FQXSzKD:4PTPjnCCdpOh
- TLSH
  T11634E011D692C1D9D07247F64E3BC53ADC1AAE261F0865C333867B6AA475EE0AF7102F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

aspackv2 backdoor bootkit defense_evasion discovery execution farfli persistence spyware stealer vmprotect
- Detects Farfli Backdoor
- Family: Farfli
  Farfli is a Windows backdoor written in C++.
  backdoor farfli
- Detects executables containing base64 encoded User Agent
- Detects executables packed with VMProtect.
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Deletes itself
  defense_evasion
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- VMProtect packed file
  Detects executables packed with VMProtect commercial packer.
  vmprotect
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral1 behavioral2