Sonicwall Signatures


Go to All Categories list.

Farfli.HW is a Trojan. A Trojan is a program that pretends to have a valid use, but in fact modifies the user's computer in malicious way. Trojans do not replicate or spread to other computers.

      Process Related Changes
      It creates the following mutex(es):
      • "AAAAAA/vr09OcFBb2wsLGxvfzxBKmnr6 vnw=="

      Network Activity
      It attempts to connect to the following remote servers:
      • (125.77.xxxxxx)

      We observed the following DNS query/queries:

      Registry Related Changes
      It makes the following registry modifications to ensure infection after system reboot:
      • HKLM\Software\Microsoft\Windows\CurrentVersion\Run\xxxxxx19c9be8b = C:\Windows\XXXXXX19C9BE8B\svchsot.exe

      Relevant Information