Adware Reports malware removal guides and threat research Updated security instructions for Windows users
Home/Malware
Threat report

Fragtor.11363 information

Published Sep 8, 2021 Malware category 3 min read
Report context

What to verify before removal

This report keeps Fragtor.11363 information in the active library because the detection has enough technical context to support a careful second-opinion scan and cleanup decision.

The technical section is meant to connect the detection name with observable evidence such as persistence entries, dropped files, unusual processes, and browser or network changes. Compare the identifiers here with the local file before deleting anything, then use the cleanup workflow to scan, quarantine, and verify the system state.

  • Confirm the detection name matches Fragtor.11363 information before removing related files.
  • Review the report for persistence entries, dropped files, unusual processes, and browser or network changes so the cleanup is based on observed behavior, not only the label.
  • Run a full scan, quarantine confirmed detections, and restart before signing back in to sensitive accounts.

Fragtor.11363 should be investigated as an active malware signal, especially if it appears with unknown processes, dropped files, or browser/network changes. The cleanup path is to verify the sample, quarantine detections, and check for follow-on payloads. The notes below include hashes, external file references, and behavior notes so you can compare the detection with the affected file before removal.

What Fragtor.11363 virus can do?

  • Executable code extraction
  • Injection (inter-process)
  • Injection (Process Hollowing)
  • Attempts to connect to a dead IP:Port (3 unique times)
  • Creates RWX memory
  • A process attempted to delay the analysis task.
  • A process created a hidden window
  • Drops a binary and executes it
  • Performs some HTTP requests
  • The binary likely contains encrypted or compressed data.
  • Executed a process and injected code into it, probably while unpacking
  • Network activity contains more than one unique useragent.
  • Installs itself for autorun at Windows startup
  • Creates a copy of itself
  • Anomalous binary characteristics
  • Uses suspicious command line tools or Windows utilities

Related domains:

api.2ip.ua
securebiz.org
astdg.top
gheorghip.tumblr.com
ocsp.comodoca.com
ocsp.usertrust.com
ocsp.sectigo.com

How to determine Fragtor.11363?



File Info:

crc32: 53D4C5C0
md5: 8fde6a28d2642e277e571db81f42fe63
name: 8FDE6A28D2642E277E571DB81F42FE63.mlw
sha1: f4fb1f0cc1c6fbe15a6b5959fe2d76aa2f95d71f
sha256: b0266821dcffebd331809ede0c719f550c912966b93797305a88b0c9417f34a3
sha512: ec56670cbfd1b929cd199ecb607fda4adca8bcf97b3cb75472db1717f99ef6cb8c4fa139de6ef15f0144617d2e32553477da263555cb4998a1c1d67975dd9c35
ssdeep: 12288:HAtpfKSsvh2NDgRwDzawGsK3tqVa6PSYJ67G2Kc5EcF:HAtuvh29gyWwgDwSy2b
type: PE32 executable (GUI) Intel 80386, for MS Windows


Version Info:

InternalName: sagzmioloke.awi
ProductVersion: 7.59.22.123
Copyright: Copyrighz (C) 2021, fudkageta
Translation: 0x0183 0x022e

Fragtor.11363 also known as:

Bkav W32.AIDetect.malware1
K7AntiVirus Trojan ( 005690681 )
Elastic malicious (high confidence)
DrWeb Trojan.Siggen14.64135
Cynet Malicious (score: 100)
ALYac Gen:Variant.Fragtor.11363
Cylance Unsafe
Sangfor Trojan.Win32.Save.a
CrowdStrike win/malicious_confidence_100% (W)
K7GW Trojan ( 005690681 )
Cyren W32/Kryptik.EWJ.gen!Eldorado
ESET-NOD32 a variant of Win32/Kryptik.HMFI
APEX Malicious
Avast Win32:DropperX-gen [Drp]
ClamAV Win.Packed.Fragtor-9888193-0
Kaspersky HEUR:Trojan-Ransom.Win32.Stop.gen
BitDefender Gen:Variant.Fragtor.11363
MicroWorld-eScan Gen:Variant.Fragtor.11363
Ad-Aware Gen:Variant.Fragtor.11363
Sophos Mal/Generic-R + Troj/Krypt-W
BitDefenderTheta Gen:NN.ZexaF.34126.Uq0@aWRBo7bG
McAfee-GW-Edition BehavesLike.Win32.Emotet.bc
FireEye Generic.mg.8fde6a28d2642e27
Emsisoft Trojan.Crypt (A)
SentinelOne Static AI – Malicious PE
Microsoft Trojan:Win32/Azorult.RT!MTB
Gridinsoft Ransom.Win32.STOP.ko!se53323
Arcabit Trojan.Fragtor.D2C63
GData Win32.Trojan.BSE.169R9YY
AhnLab-V3 CoinMiner/Win.Glupteba.R438695
McAfee RDN/Generic.grp
MAX malware (ai score=85)
VBA32 BScope.Backdoor.Androm
Malwarebytes Trojan.MalPack.GS
Panda Trj/GdSda.A
Rising Trojan.Kryptik!1.D91D (CLASSIC)
Ikarus Trojan.Crypt
MaxSecure Trojan.Malware.300983.susgen
Fortinet W32/GenKryptik.FJYS!tr
AVG Win32:DropperX-gen [Drp]

How to remove Fragtor.11363?

Recommended second-opinion scan

Verify the infection before changing system settings

Use GridinSoft Anti-Malware to run a full scan, review detected persistence entries, and quarantine confirmed threats before restarting Windows.

Download GridinSoft Anti-Malware
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.