Categories: Backdoor

Backdoor:Win32/Farfli.AAB!MTB information

The Backdoor:Win32/Farfli.AAB!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Backdoor:Win32/Farfli.AAB!MTB virus can do?

Sample contains Overlay data
Reads data out of its own binary image
Unconventionial binary language: Chinese (Simplified)
Unconventionial language used in binary resources: Chinese (Simplified)
Authenticode signature is invalid
Uses Windows utilities to create a scheduled task
Anomalous binary characteristics
Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Backdoor:Win32/Farfli.AAB!MTB?


File Info:
name: 935C2EDEC8784B7B7CED.mlwpath: /opt/CAPEv2/storage/binaries/3752d647876953490e4f63cc49c6f7fa690368b54e6652b60b32dc1f1ec7ed1bcrc32: 6377E3E4md5: 935c2edec8784b7b7ceda75340214518sha1: 19b7bd6b406e6a9ca89ce39a49b7d7f89629aa58sha256: 3752d647876953490e4f63cc49c6f7fa690368b54e6652b60b32dc1f1ec7ed1bsha512: 7f7e17fc98616195d54f22345653efdec3a179248da91dea7f3c3c0fabcf8d8b6100601dcfb1355babe80679941c0290d25e1abbecd24aae0810e5180e11ed5dssdeep: 3072:JX/k8hHvzJT1wQTNpvgPC4WaCFOC4W9gD5zaR6SZLmqY:JX88VvM0qCv5OC4WIzazsftype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1AFD38D42FA4540FED6A4153C24FB7776D73F6DAA9E08EF837314FA590872050AB22297sha3_384: 1cdc83ef042c286471bc3b1c6e8b3b5035f4526ccb90c6d279c0eeb27e706399fece4f6c0746a9e48b17c7da62783da6ep_bytes: 558bec6aff68f8134000e9ddf1ffff64timestamp: 2009-05-18 01:37:35
Version Info:
Comments: CompanyName: 360安全中心FileDescription: 360安全卫士签名验证模块FileVersion: 0, 0, 0, 0InternalName: 360VerifyLegalCopyright: Copyright (C) 2006-2008 360.cnLegalTrademarks: OriginalFilename: 360Verify.dllPrivateBuild: ProductName: 360安全卫士签名验证模块ProductVersion: 1, 0, 0, 1001SpecialBuild: Translation: 0x0804 0x04b0

Backdoor:Win32/Farfli.AAB!MTB also known as:

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Generic.lCR2
Elastic	malicious (high confidence)
DrWeb	BackDoor.Pigeon.22385
MicroWorld-eScan	Gen:Variant.Lazy.210290
FireEye	Generic.mg.935c2edec8784b7b
CAT-QuickHeal	Trojan.Aksula.A
Skyhigh	BehavesLike.Win32.Generic.ch
McAfee	BackDoor-DZB
Malwarebytes	Generic.Trojan.Dialer.DDS
VIPRE	Gen:Variant.Lazy.210290
Sangfor	Suspicious.Win32.Save.ins
BitDefender	Gen:Variant.Lazy.210290
Cybereason	malicious.b406e6
BitDefenderTheta	AI:Packer.72874C341F
VirIT	Trojan.Win32.OLG.JKN
Symantec	Trojan.Dropper
ESET-NOD32	a variant of Win32/Dialer.NEW
APEX	Malicious
ClamAV	Win.Trojan.Zegost-9760656-0
Kaspersky	Backdoor.Win32.FirstInj.t
Alibaba	Malware:Win32/km_26ae.None
NANO-Antivirus	Trojan.Win32.FirstInj.zaof
ViRobot	Trojan.Win32.PSWMagania.29184.F
Rising	Trojan.Agent!1.650A (CLASSIC)
Sophos	Mal/Redos-H
F-Secure	Trojan.TR/Dialer.NHO
Baidu	Win32.Trojan.Dialer.p
Zillya	Backdoor.Agent.Win32.6343
TrendMicro	BKDR_AGENT.SMZQ
Emsisoft	Gen:Variant.Lazy.210290 (B)
Ikarus	Trojan-Dropper.Agent
MAX	malware (ai score=100)
Jiangmin	Backdoor/Delf.lcc
Webroot	Trojan:Win32/Redosdru.K
Google	Detected
Avira	TR/Dialer.NHO
Varist	W32/Backdoor.SRVY-5412
Antiy-AVL	Trojan[Backdoor]/Win32.FirstInj
Kingsoft	Win32.HeurC.KVM005.a
Microsoft	Backdoor:Win32/Farfli.AAB!MTB
Xcitium	TrojWare.Win32.Magania.~all@f80ty
Arcabit	Trojan.Lazy.D33572
ZoneAlarm	Backdoor.Win32.FirstInj.t
GData	Gen:Variant.Lazy.210290
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Magania.C1664
VBA32	BScope.Trojan.SvcHorse.01643
ALYac	Gen:Variant.Lazy.210290
DeepInstinct	MALICIOUS
Cylance	unsafe
Panda	Generic Malware
TrendMicro-HouseCall	BKDR_AGENT.SMZQ
Tencent	Trojan.Win32.Zeogst.ab
Yandex	Trojan.GenAsa!TwT3bfT3kGM
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.1140808.susgen
Fortinet	W32/Magania.ADW!tr.pws
AVG	Win32:Agent-AGNT [Drp]
Avast	Win32:Agent-AGNT [Drp]