About “Backdoor:Win32/Farfli.P” infection

The Backdoor:Win32/Farfli.P is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Backdoor:Win32/Farfli.P virus can do?

• Sample contains Overlay data
• Reads data out of its own binary image
• Drops a binary and executes it
• Unconventionial language used in binary resources: Chinese (Simplified)
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Backdoor:Win32/Farfli.P?

File Info:
name: 1BC75EFCDCDC5FE5FBC2.mlw
path: /opt/CAPEv2/storage/binaries/7143f9b23b94cde2af7695d29a6a3875a855a4be6cf08385bb60686f5e958c81
crc32: 33CF72C4
md5: 1bc75efcdcdc5fe5fbc23c2ab572c251
sha1: f7212e5664a8e51fa63cb193cece2351b39feb9a
sha256: 7143f9b23b94cde2af7695d29a6a3875a855a4be6cf08385bb60686f5e958c81
sha512: 44aaf6cc1a77ce139d737560fb6448f3a69ff25f89b5f5ad17338bd59bebf1b7da7d5eab74b4cd5ad10fb852a62a6eba45196752add95f87ba0c862ccc92bf79
ssdeep: 1536:fowahuG0ipcAgciDeS2mFnToIf62MNFyxPvV5E2:fowahv0yJiDeS2mtTBf6NNFyxPU2
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1F8F6F1AB944824A260BD7B51F10B07D6C293BEB1AA14DF908084FB96C764544FFEDBD3
sha3_384: ff6e10194b4c0c10328d76f7f0a1ba2be24450be12f828215b566dcd3556b174e161224583c9bda4f2c888723a7e2bb9
ep_bytes: 558bec6aff68e0fe4000683aa6400064
timestamp: 2010-11-15 15:47:30

Version Info:
CompanyName: Microsoft Corporation
FileDescription: Audit User Program
FileVersion: 5.2.3790.3959 (srv03_sp2_rtm.070216-1710)
InternalName: auditusr
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFilename: AUDITUSR.EXE
ProductName: Microsoft® Windows® Operating System
ProductVersion: 5.2.3790.3959
Translation: 0x0409 0x04b0

Backdoor:Win32/Farfli.P also known as:

How to remove Backdoor:Win32/Farfli.P?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.