Backdoor:Win32/Farfli.GMC!MTB information

The Backdoor:Win32/Farfli.GMC!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Backdoor:Win32/Farfli.GMC!MTB virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Unconventionial binary language: Chinese (Simplified)
• Unconventionial language used in binary resources: Chinese (Simplified)
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Anomalous binary characteristics
• Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Backdoor:Win32/Farfli.GMC!MTB?

File Info:
name: 8D10AEAE0F5424063EAD.mlw
path: /opt/CAPEv2/storage/binaries/2c29e9fb5bb18800ae118c7de47b8a45f7426099cf4f66f000d1637619dba9e5
crc32: 55EFB2AA
md5: 8d10aeae0f5424063ead27ffcd25517c
sha1: 6478ec878d9768a3baaf8995c1039d3461a2953c
sha256: 2c29e9fb5bb18800ae118c7de47b8a45f7426099cf4f66f000d1637619dba9e5
sha512: 4978d0fe73b2809ba0fea05c2efd8b874b97deff3bc63bf4a4f002325e9caba54705f6798ecf4a421483ebee6b85ad48412415448e45a46d7f8a7b993e767ffa
ssdeep: 196608:5aEbM3zOrVgfAALu4aVpW+++Bd7oHWDDq:s/3aYcjOT0WWfq
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1336612B4AA514416C4F10BB093B6CB68FD356F3247F059CAD3A37E8A3A7426399254FC
sha3_384: 6541bb3050333fa205d215431ca068d9a29de31cf7a5e059136bc57c85847a0973d224a020b4cf7e134d8de2a2c8bdd9
ep_bytes: 3bc0741ceb00db2ddc05b700ffffffff
timestamp: 1970-01-01 00:00:00

Version Info:
Comments: 通达信
CompanyName: (通达信)深圳市财富趋势科技股份有限公司
FileDescription: TDX 应用程序
FileVersion: 1, 0, 0, 1
InternalName: TDX
LegalCopyright: 
LegalTrademarks: 通达信
OriginalFilename: tdxw.exe
PrivateBuild: 
ProductName: TDX 应用程序
ProductVersion: 1, 0, 0, 1
SpecialBuild: 
Translation: 0x0804 0x04b0

Backdoor:Win32/Farfli.GMC!MTB also known as:

How to remove Backdoor:Win32/Farfli.GMC!MTB?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.