SonicALERT
Search

Sonicwall Signatures

 

Go to All Categories list.


  Farfli.HW
Farfli.HW is a Trojan. A Trojan is a program that pretends to have a valid use, but in fact modifies the user's computer in malicious way. Trojans do not replicate or spread to other computers.

      Process Related Changes
      It creates the following mutex(es):
      • "AAAAAA/vr09OcFBb2wsLGxvfzxBKmnr6 vnw=="

      Network Activity
      It attempts to connect to the following remote servers:
      • amwwxff.3322.org:8000 (125.77.xxxxxx)

      We observed the following DNS query/queries:
      • amwwxff.3322.org

      Registry Related Changes
      It makes the following registry modifications to ensure infection after system reboot:
      • HKLM\Software\Microsoft\Windows\CurrentVersion\Run\xxxxxx19c9be8b = C:\Windows\XXXXXX19C9BE8B\svchsot.exe


      Relevant Information