farfli | 1696b2fea5108eac6e0c5c7f0217d98b73859d1498b4688b556a0e6cb1a54d42

General

Target
2026-11-12_ae2ce4fa0af1331e9d0e4378dbb23777_elex_wannacry
Size 272KB
Sample261112-xtwc7abs6t
SHA256 1696b2fea5108eac6e0c5c7f0217d98b73859d1498b4688b556a0e6cb1a54d42
MD5 ae2ce4fa0af1331e9d0e4378dbb23777
SHA1 f481e5238dd3de59acc02a2546df555f77be9e10
SHA512 57b8aa614edccb50eda73e02471cc597f6affe3c8d49c5c6c1a3f0785bb006f948707207d111dc9b6385977c340c790bb13500ce5b42f8b2221dfb7d23547c8e
SSDEEP 6144:H8AbwMmJOyOK5ZV7NHPR519jtr5a8MueZG7H:PwVJOp8FNprdrMul7
TLSH
T1E854CE11F621C945E4724C3177AE59298764FC19EB4CB243E3F86B0FDC2EE92A93C256
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-11-12_ae2ce4fa0af1331e9d0e4378dbb23777_elex_wannacry
- Size 272KB
- SHA256 1696b2fea5108eac6e0c5c7f0217d98b73859d1498b4688b556a0e6cb1a54d42
- MD5 ae2ce4fa0af1331e9d0e4378dbb23777
- SHA1 f481e5238dd3de59acc02a2546df555f77be9e10
- SHA512 57b8aa614edccb50eda73e02471cc597f6affe3c8d49c5c6c1a3f0785bb006f948707207d111dc9b6385977c340c790bb13500ce5b42f8b2221dfb7d23547c8e
- SSDEEP 6144:H8AbwMmJOyOK5ZV7NHPR519jtr5a8MueZG7H:PwVJOp8FNprdrMul7
- TLSH
  T1E854CE11F621C945E4724C3177AE59298764FC19EB4CB243E3F86B0FDC2EE92A93C256
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor bootkit defense_evasion discovery execution farfli persistence spyware stealer upx
- Detects Farfli Backdoor
- Family: Farfli
  Farfli is a Windows backdoor written in C++.
  backdoor farfli
- Custom signature
  
  Detects executables containing base64 encoded User Agent
- Custom signature
  
  UPX dump on OEP (original entry point)
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Deletes itself
  defense_evasion
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2