Categories: Malware

Win32/Farfli.ARD information

The Win32/Farfli.ARD is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Farfli.ARD virus can do?

Attempts to connect to a dead IP:Port (2 unique times)
Reads data out of its own binary image
Drops a binary and executes it
Unconventionial binary language: Chinese (Simplified)
Unconventionial language used in binary resources: Chinese (Simplified)
Sniffs keystrokes
Attempts to repeatedly call a single API many times in order to delay analysis time
Installs itself for autorun at Windows startup
Creates a copy of itself
Anomalous binary characteristics

Related domains:

ip.yototoo.com

How to determine Win32/Farfli.ARD?


File Info:
crc32: A20AD781md5: 16bede9eb3ba6da30eb5e3470e3bc6aaname: 16BEDE9EB3BA6DA30EB5E3470E3BC6AA.mlwsha1: 9e8867161f6fbe213d4b26bf0ad03173c9230231sha256: 6da6e4590fb510796d4bf85fc4e29a0d96707c15020606fb9bd1660639136468sha512: 378a91ee62c4283978554e36b1b2303fe0f7aff60631841d72bb40ca3bc913584f1e982deecd011af0cf05586b41e085e1c18435cc9093f186efba10b70527d6ssdeep: 3072:PmZBWwd86YpyFnpdp/xVRXEgoY8fv/fNbJzZ7EBMX8WryN:PTnpyNpH/xVyfY8fv/fX97EYqtype: PE32 executable (GUI) Intel 80386, for MS Windows
Version Info:
LegalCopyright: x7248x6743x6240x6709 (C) 2012InternalName: adbrowserFileVersion: 1, 0, 0, 9CompanyName: Net.Soft StudioPrivateBuild: 20120830.01LegalTrademarks: Comments: ProductName: adbrowserSpecialBuild: ProductVersion: 1, 0, 0, 9FileDescription: P2Px7ec8x7ed3x8005x8f85x52a9x6a21x5757OriginalFilename: adbrowser.EXETranslation: 0x0804 0x04b0

Win32/Farfli.ARD also known as:

Bkav	W32.AIDetect.malware1
K7AntiVirus	Trojan ( 0040f7ad1 )
Elastic	malicious (high confidence)
DrWeb	Trojan.Siggen6.27861
Cynet	Malicious (score: 100)
CAT-QuickHeal	Trojan.Aksula.A
ALYac	Backdoor.Zegost.BC
Cylance	Unsafe
Zillya	Trojan.Kryptik.Win32.737668
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (W)
Alibaba	Backdoor:Win32/Farfli.b541c87a
K7GW	Trojan ( 0040f7ad1 )
Cybereason	malicious.eb3ba6
Baidu	Win32.Trojan.Farfli.bg
Cyren	W32/S-3d9bc1fd!Eldorado
Symantec	Trojan.Gen.MBT
ESET-NOD32	Win32/Farfli.ARD
Zoner	Trojan.Win32.29512
APEX	Malicious
Avast	Win32:Farfli-CF [Cryp]
ClamAV	Win.Trojan.Zegost-7007928-0
Kaspersky	Backdoor.Win32.Farfli.alus
BitDefender	Backdoor.Zegost.BC
NANO-Antivirus	Trojan.Win32.TrjGen.csulmd
ViRobot	Trojan.Win32.Agent.215901
SUPERAntiSpyware	Trojan.Agent/Gen-Siggen
MicroWorld-eScan	Backdoor.Zegost.BC
Tencent	Malware.Win32.Gencirc.10b406f5
Ad-Aware	Backdoor.Zegost.BC
Sophos	ML/PE-A + Troj/Zegost-CV
Comodo	TrojWare.Win32.Kryptik.BPVQ@56xtf6
BitDefenderTheta	Gen:NN.ZexaF.34722.ni1@aOvpuhhb
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	BKDR_ZEGOST.SML
McAfee-GW-Edition	BehavesLike.Win32.Backdoor.dh
FireEye	Generic.mg.16bede9eb3ba6da3
Emsisoft	Backdoor.Zegost.BC (B)
SentinelOne	Static AI – Malicious PE
Jiangmin	Trojan/Generic.avrta
Avira	BDS/Zegost.mdqcz
Gridinsoft	Trojan.Win32.Gen.vl!n
Arcabit	Backdoor.Zegost.BC
GData	Backdoor.Zegost.BC
TACHYON	Backdoor/W32.Farfli.215905
AhnLab-V3	Trojan/Win32.Scar.R65072
Acronis	suspicious
McAfee	BackDoor-FCGT!16BEDE9EB3BA
MAX	malware (ai score=86)
VBA32	BScope.Trojan.Dynamer
Malwarebytes	Backdoor.Staser
Panda	Generic Malware
TrendMicro-HouseCall	BKDR_ZEGOST.SML
Rising	Backdoor.Farfli!1.B6C5 (CLASSIC)
Ikarus	Backdoor.Win32.Zegost
MaxSecure	Win.MxResIcn.Heur.Gen
Fortinet	W32/Farfli.PZA!tr
AVG	Win32:Farfli-CF [Cryp]