Backdoor:Win32/Farfli!pz removal tips

The Backdoor:Win32/Farfli!pz is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Backdoor:Win32/Farfli!pz virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Uses Windows utilities for basic functionality
• CAPE extracted potentially suspicious content
• Unconventionial language used in binary resources: Chinese (Simplified)
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• A ping command was executed with the -n argument possibly to delay analysis
• Uses Windows utilities to create a scheduled task
• CAPE detected the PCRat malware family
• Anomalous binary characteristics
• Uses suspicious command line tools or Windows utilities
• Yara detections observed in process dumps, payloads or dropped files

How to determine Backdoor:Win32/Farfli!pz?

File Info:
name: EC480C6CAC10F8E3D778.mlw
path: /opt/CAPEv2/storage/binaries/de4b7a38110297035169ae3e152d0c08bf307ebc7d2b4883a00e1fa1f93370f4
crc32: 01E78016
md5: ec480c6cac10f8e3d7782a756ef93173
sha1: 0e2e79bf6e9e48a493d3cd2361fd5455510bd1ef
sha256: de4b7a38110297035169ae3e152d0c08bf307ebc7d2b4883a00e1fa1f93370f4
sha512: 1508956af085d70d88e94106a2b949efbb871f08aca785ef64ca5b6f57e56bb6c721424a23c1545edddbec04a6967307587f571e205653b6a5e1d61b3cb4b6db
ssdeep: 24576:dOyHutimZ9VSly2hVvHW6qMnSbTBBhBMNK:QHPkVOBTK
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1E8557A591BAB4256DB5877B9C8A6A69409090F432F58C4B11E311E1EBD2734FFC23EBC
sha3_384: 84b4db2a5b37c8628a8c01a026599af96ec4cccd04d0e1c3c2f0c612589799e3804821d58dfa8bbdd9200a35a509a269
ep_bytes: 558bec6aff6800645300684495530064
timestamp: 2021-08-06 16:38:04

Version Info:
0: [No Data]

Backdoor:Win32/Farfli!pz also known as:

How to remove Backdoor:Win32/Farfli!pz?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.