Malware

About “Win32/Farfli.CYQ” infection

Malware Removal

The Win32/Farfli.CYQ is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Win32/Farfli.CYQ virus can do?

  • Executable code extraction
  • Attempts to connect to a dead IP:Port (1 unique times)
  • Creates RWX memory
  • A process attempted to delay the analysis task.
  • Drops a binary and executes it
  • The binary likely contains encrypted or compressed data.
  • Uses Windows utilities for basic functionality
  • Deletes its original binary from disk
  • Attempts to repeatedly call a single API many times in order to delay analysis time
  • Installs itself for autorun at Windows startup
  • Creates a hidden or system file
  • Creates a copy of itself
  • Uses suspicious command line tools or Windows utilities

How to determine Win32/Farfli.CYQ?


File Info:

crc32: 90DE68A8
md5: 8998b95562f0edfabc0a2a594585f16e
name: 8998B95562F0EDFABC0A2A594585F16E.mlw
sha1: 261fc5f925f6d43ed54deae1f6fd9ad9768d481a
sha256: 5c34ee013992e476c777d519ec38d78cb30d97db9889ec602b8f24bf57662dde
sha512: 8b57e4bba01a0dd847fdf92990812d5b2eefb22aa5fd7cb853b1bc535aea0b65919785560c36f1b77559f60568aa477564166b4fdf1e8a4972776be488e6c72e
ssdeep: 12288:MrPt/6Lo/BsS8NSFSQE6ZWn5tx5uU29cg+8hkBq:jLo/B78wyxQ4GhkBq
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

LegalCopyright: Copyright (C) 2021
InternalName: AAAA
FileVersion: 1, 0, 0, 1
CompanyName:
LegalTrademarks:
ProductName: Application AAAA
ProductVersion: 1, 0, 0, 1
FileDescription: Application MFC AAAA
OriginalFilename: AAAA.EXE
Translation: 0x040c 0x04b0

Win32/Farfli.CYQ also known as:

K7AntiVirusRiskware ( 0040eff71 )
Elasticmalicious (high confidence)
DrWebBackDoor.Spy.422
CAT-QuickHealTrojan.GenericRI.S22015329
McAfeeGenericRXOD-IK!8998B95562F0
CylanceUnsafe
ZillyaTrojan.Generic.Win32.1392882
CrowdStrikewin/malicious_confidence_90% (W)
K7GWRiskware ( 0040eff71 )
Cybereasonmalicious.562f0e
CyrenW32/Trickbot.GW.gen!Eldorado
SymantecML.Attribute.HighConfidence
ESET-NOD32Win32/Farfli.CYQ
APEXMalicious
AvastWin32:BackdoorX-gen [Trj]
CynetMalicious (score: 100)
KasperskyHEUR:Trojan.Win32.Agent.gen
BitDefenderDeepScan:Generic.Mulinex.0CF9EC3D
NANO-AntivirusTrojan.Win32.Mlw.iucbro
MicroWorld-eScanDeepScan:Generic.Mulinex.0CF9EC3D
TencentMalware.Win32.Gencirc.10ce6767
Ad-AwareDeepScan:Generic.Mulinex.0CF9EC3D
SophosTroj/Farfli-DW
BitDefenderThetaGen:NN.ZexaF.34170.Lq0@aihzYFoe
VIPRETrojan.Win32.Generic!BT
TrendMicroBKDR_ZEGOST.SM34
McAfee-GW-EditionBehavesLike.Win32.Generic.jc
FireEyeGeneric.mg.8998b95562f0edfa
EmsisoftDeepScan:Generic.Mulinex.0CF9EC3D (B)
SentinelOneStatic AI – Malicious PE
JiangminTrojan.Generic.gvvqu
AviraHEUR/AGEN.1101570
Antiy-AVLTrojan/Generic.ASMalwS.332E8B4
MicrosoftBackdoor:Win32/Zegost.KM!MTB
GridinsoftBackdoor.Win32.AI.oa!s1
ZoneAlarmHEUR:Backdoor.Win32.Generic
GDataDeepScan:Generic.Mulinex.0CF9EC3D
AhnLab-V3Backdoor/Win.Zegost.R422117
Acronissuspicious
VBA32BScope.Backdoor.Farfli
MAXmalware (ai score=86)
MalwarebytesBackdoor.Farfli
TrendMicro-HouseCallBKDR_ZEGOST.SM34
YandexTrojan.Agent!UvZYx0QUaws
IkarusBackdoor.Win32.Zegost
MaxSecureTrojan.Malware.7164915.susgen
FortinetW32/Farfli.CYQ!tr
AVGWin32:BackdoorX-gen [Trj]
Paloaltogeneric.ml

How to remove Win32/Farfli.CYQ?

Win32/Farfli.CYQ removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment