What is "Win32/Farfli.BGG"?

The Win32/Farfli.BGG is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Farfli.BGG virus can do?

Executable code extraction
At least one process apparently crashed during execution
Attempts to connect to a dead IP:Port (1 unique times)
Presents an Authenticode digital signature
Creates RWX memory
Drops a binary and executes it
Unconventionial binary language: Chinese (Simplified)
Unconventionial language used in binary resources: Chinese (Simplified)
The binary likely contains encrypted or compressed data.
Attempts to repeatedly call a single API many times in order to delay analysis time
Installs itself for autorun at Windows startup
Checks the CPU name from registry, possibly for anti-virtualization
Checks the system manufacturer, likely for anti-virtualization
Creates a copy of itself

Related domains:

z.whorecord.xyz

a.tomx.xyz

d.nxxxn.ga

How to determine Win32/Farfli.BGG?


File Info:
crc32: EEDE6929
md5: 3292eacbcf0b9ef4abf4aca9cbf188cc
name: SQLSernsf.exe
sha1: f9dfc3df36e4d0dd9c899ec9093d5149f25af159
sha256: 32cae5bc6fbbaeb29bcc4afad49865832f461de87eb1dd35891a9db34bbea753
sha512: 79a558b726205abdf8171036ac0e5a4efc403d3ab3fb8b89c4882803252bde6214b4abffe25e0425908d30ab118b29632e17c9b64c8dea9a3ed54df3fe7bc0fb
ssdeep: 6144:Uv5zQJVb5p72cHF1ybDFwekh212KhvwIb759QOaBjpaVRPu23E2rJmWjFc94:U4VOiF1WD7kE1dTYOi8V5u23zmWFy4
type: MS-DOS executable, MZ for MS-DOS

Version Info:
LegalCopyright: (C) 360.cn All Rights Reserved.
InternalName: LSPFix
FileVersion: 7, 1, 3, 1057
CompanyName: 360.cn
ProductName: 360x5b89x5168x536bx58eb
ProductVersion: 7, 1, 3, 1057
FileDescription: 360x5b89x5168x536bx58eb LSPx4feex590dx6a21x5757
OriginalFilename: LSPFix.EXE
Translation: 0x0804 0x04b0

Win32/Farfli.BGG also known as:

MicroWorld-eScan	Gen:Variant.Strictor.221168
FireEye	Generic.mg.3292eacbcf0b9ef4
CAT-QuickHeal	Trojan.Magania.18692
McAfee	GenericRXDW-XG!495EEB1C3D52
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
K7AntiVirus	Trojan ( 004c81771 )
BitDefender	Gen:Variant.Strictor.221168
K7GW	Trojan ( 004c81771 )
Cybereason	malicious.bcf0b9
BitDefenderTheta	Gen:NN.ZexaF.33558.xm1@aaD9Naoj
Cyren	W32/S-6cc11623!Eldorado
Symantec	ML.Attribute.HighConfidence
Avast	Win32:Malware-gen
GData	Gen:Variant.Strictor.221168
Kaspersky	Trojan.Win32.Agent.xabxmr
Rising	Backdoor.Farfli!8.B4 (TFE:5:bL8vVvLdNzM)
Ad-Aware	Gen:Variant.Strictor.221168
Comodo	TrojWare.Win32.Fusing.CF@5afr59
F-Secure	Heuristic.HEUR/AGEN.1042577
DrWeb	BackDoor.Farfli.96
Zillya	Trojan.Banbra.Win32.29854
Invincea	heuristic
McAfee-GW-Edition	GenericRXDW-XG!495EEB1C3D52
Trapmine	malicious.high.ml.score
CMC	Virus.Win32.Sality!O
Emsisoft	Gen:Variant.Strictor.221168 (B)
APEX	Malicious
F-Prot	W32/S-6cc11623!Eldorado
Jiangmin	Backdoor.Farfli.cmb
MaxSecure	Trojan.Malware.300983.susgen
Avira	HEUR/AGEN.1042577
MAX	malware (ai score=89)
Endgame	malicious (high confidence)
Arcabit	Trojan.Strictor.D35FF0
SUPERAntiSpyware	Backdoor.PcClient/Variant
ZoneAlarm	Trojan.Win32.Agent.xabxmr
Microsoft	Backdoor:Win32/PcClient.ZR
SentinelOne	DFI – Malicious PE
AhnLab-V3	Malware/Win32.Generic.C2832100
Acronis	suspicious
ALYac	Gen:Variant.Strictor.221168
VBA32	BScope.Trojan-GameThief.Magania
Malwarebytes	Backdoor.Farfli
Zoner	Trojan.Win32.80229
ESET-NOD32	Win32/Farfli.BGG
Tencent	Malware.Win32.Gencirc.10b40de8
Yandex	Trojan.PWS.Banbra!fVil7drZyCo
Ikarus	Trojan.Win32.Farfli
Fortinet	W32/Midie.26C0!tr
Webroot	W32.Trojan.Gen
AVG	Win32:Malware-gen
CrowdStrike	win/malicious_confidence_80% (D)

How to remove Win32/Farfli.BGG?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

What is “Win32/Farfli.BGG”?