Backdoor.Win32.Farfli.bweu (file analysis)

The Backdoor.Win32.Farfli.bweu is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Backdoor.Win32.Farfli.bweu virus can do?

Attempts to connect to a dead IP:Port (1 unique times)
Authenticode signature is invalid
Anomalous binary characteristics

How to determine Backdoor.Win32.Farfli.bweu?


File Info:
name: F1D8478878B6CA778F2C.mlw
path: /opt/CAPEv2/storage/binaries/c751dddb4906e38531aee06e08ec474cf1449e8169a1c342a7e2eca24895f4d8
crc32: 5C0A68BB
md5: f1d8478878b6ca778f2c344517381e48
sha1: 3ff0bb52f50b56638473db92b105a868c3ee50c0
sha256: c751dddb4906e38531aee06e08ec474cf1449e8169a1c342a7e2eca24895f4d8
sha512: a9a4be1623db9e7faa8d0e052f96043daee1960a31f080e4a5076bece4c24596195eaaa74f8fa41e244f1715efb85504edcba365245d5d9ba2451804ccf40aed
ssdeep: 768:ZJqwIjc8IbCE9WRJppQ5+zH2GHRrTwiUJs4IDELbjC1wRlsIEHJilDe9:XzIg0NdOCHoL0wRvE3
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T114E22906AA55E432C56184B066783F276BBEC475056FAC07BBC0C51B2DB98ABD13DF0B
sha3_384: b22d31b5c60da58f015efe7047457cd61caffec015a4c3ef985e33ff4ff13a13e7f04025f431f40d199a29d14ef5bd74
ep_bytes: 558bec6aff683018400068f074400064
timestamp: 2014-09-21 13:37:41

Version Info:
0: [No Data]

Backdoor.Win32.Farfli.bweu also known as:

Bkav	W32.AIDetect.malware1
Elastic	malicious (high confidence)
MicroWorld-eScan	Generic.Zegost.3.F5B8D251
FireEye	Generic.mg.f1d8478878b6ca77
CAT-QuickHeal	Backdoor.Farfli.26898
McAfee	Trojan-FJYJ!F1D8478878B6
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 0040f8861 )
Alibaba	Backdoor:Win32/Farfli.0fa7028d
K7GW	Trojan ( 0040f8861 )
Cybereason	malicious.878b6c
BitDefenderTheta	AI:Packer.FD586FB11E
Cyren	W32/S-7264c6d1!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Agent.QID
TrendMicro-HouseCall	BKDR_FARFLI.SMNA
Paloalto	generic.ml
Kaspersky	Backdoor.Win32.Farfli.bweu
BitDefender	Generic.Zegost.3.F5B8D251
Avast	Win32:Dropper-ODE [Drp]
Tencent	Win32.Trojan.Beaugrit.Ednk
Ad-Aware	Generic.Zegost.3.F5B8D251
Emsisoft	Generic.Zegost.3.F5B8D251 (B)
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	BKDR_FARFLI.SMNA
McAfee-GW-Edition	BehavesLike.Win32.Generic.nh
Sophos	ML/PE-A + Troj/Beaugrit-A
SentinelOne	Static AI – Malicious PE
GData	Generic.Zegost.3.F5B8D251
Avira	TR/Beaugrit.aba
MAX	malware (ai score=83)
Antiy-AVL	Trojan/Generic.ASMalwS.33F7FEC
Arcabit	Generic.Zegost.3.F5B8D251
Microsoft	Backdoor:Win32/Zegost.CD!bit
Cynet	Malicious (score: 100)
Acronis	suspicious
VBA32	BScope.Trojan.Wacatac
ALYac	Generic.Zegost.3.F5B8D251
Malwarebytes	Malware.AI.2058637976
APEX	Malicious
Rising	Backdoor.Fusing!1.BCB6 (CLOUD)
Yandex	Trojan.GenAsa!+x23ube/zVA
Ikarus	Trojan-Downloader.Win32.Agent
eGambit	Unsafe.AI_Score_99%
Fortinet	W32/Agent.QRW!tr
AVG	Win32:Dropper-ODE [Drp]
Panda	Trj/GdSda.A
CrowdStrike	win/malicious_confidence_100% (D)

How to remove Backdoor.Win32.Farfli.bweu?

Backdoor.Win32.Farfli.bweu removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X