Malware

Fragtor.16412 (file analysis)

Malware Removal

The Fragtor.16412 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Fragtor.16412 virus can do?

  • Behavioural detection: Executable code extraction – unpacking
  • Yara rule detections observed from a process memory dump/dropped files/CAPE
  • Creates RWX memory
  • NtSetInformationThread: attempt to hide thread from debugger
  • Enumerates the modules from a process (may be used to locate base addresses in process injection)
  • Reads data out of its own binary image
  • CAPE extracted potentially suspicious content
  • The binary contains an unknown PE section name indicative of packing
  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid
  • CAPE detected the EnigmaStub malware family
  • Anomalous binary characteristics

How to determine Fragtor.16412?



File Info:

name: 2D747CEFB8D03CFA565B.mlw
path: /opt/CAPEv2/storage/binaries/8ec385dbaa141bbc62d27b7d6d3d146a64b3275c261fb6956037875a4323f6c2
crc32: 60FD3ABA
md5: 2d747cefb8d03cfa565b3d699f3dd7ba
sha1: a976dc0e2f52c8f80c2179c25a6e18e2f2410f50
sha256: 8ec385dbaa141bbc62d27b7d6d3d146a64b3275c261fb6956037875a4323f6c2
sha512: 225c3bc3baefeac5e5f8a2b7740a19cdb7b497349ceb86c6a560f01ad79a6939296d8f792c0d9fd91ad2bcc3bf4bce2ac0d76c08e594ed85882ee4f68c1101ba
ssdeep: 24576:T7dsjJFUeJOZD39bHYpKYQZLD3PYQSPzrOMSlaJDsSoIYR:TsJVJmN2KR6rvSlEDPod
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1A935333D98608C8FC846CAFA64B53A6F489F607DA987FB2B05D338A678F5930D115713
sha3_384: 047cc4a85c1998c169a3168694987198ebce7fed76d56e59198693ae9718e2993c853f1b280b0bbc3ef2abd7fbc2b9ec
ep_bytes: 558bec83c4f0b800104000e801000000
timestamp: 2019-04-29 15:41:20


Version Info:

Translation: 0x0000 0x04b0
Comments: glxwmxa2ihu
CompanyName: rar41eeurdx
FileDescription: may3sky4o5q
FileVersion: 2.6.5.1
InternalName: EEEEE.exe
LegalCopyright: trneg3bphi1
OriginalFilename: EEEEE.exe
ProductName: may3sky4o5q
ProductVersion: 2.6.5.1
Assembly Version: 2.6.5.1

Fragtor.16412 also known as:

BkavW32.AIDetect.malware2
LionicTrojan.Win32.Generic.4!c
Elasticmalicious (high confidence)
MicroWorld-eScanGen:Variant.Fragtor.16412
FireEyeGeneric.mg.2d747cefb8d03cfa
McAfeeArtemis!2D747CEFB8D0
CylanceUnsafe
VIPRETrojan.Win32.Generic!BT
SangforTrojan.Win32.Save.a
K7AntiVirusTrojan ( 0055f2201 )
AlibabaTrojan:Win32/Skeeyah.765c6949
K7GWTrojan ( 0055f2201 )
Cybereasonmalicious.fb8d03
CyrenW32/Trojan.FFG.gen!Eldorado
SymantecML.Attribute.HighConfidence
ESET-NOD32a variant of Win32/Packed.Enigma.DS
APEXMalicious
Paloaltogeneric.ml
KasperskyHEUR:Trojan.Win32.Generic
BitDefenderGen:Variant.Fragtor.16412
NANO-AntivirusTrojan.Win32.Inject3.fprfea
AvastWin32:Malware-gen
TencentWin32.Trojan.Generic.Htmi
Ad-AwareGen:Variant.Fragtor.16412
SophosMal/Generic-S
ComodoMalware@#3p22y103vtpn9
DrWebTrojan.Inject3.3451
ZillyaTrojan.Generic.Win32.787531
McAfee-GW-EditionBehavesLike.Win32.Generic.tc
EmsisoftGen:Variant.Fragtor.16412 (B)
SentinelOneStatic AI – Malicious PE
GDataGen:Variant.Fragtor.16412
JiangminTrojan.Generic.dxsvi
WebrootW32.Trojan.Gen
AviraHEUR/AGEN.1128094
Antiy-AVLTrojan/Generic.ASBOL.C669
ArcabitTrojan.Fragtor.D401C
MicrosoftTrojan:Win32/Skeeyah.A!bit
CynetMalicious (score: 100)
AhnLab-V3Trojan/Win32.Skeeyah.C3218904
Acronissuspicious
BitDefenderThetaGen:NN.ZexaF.34114.gz0@aqAbMPd
ALYacGen:Variant.Fragtor.16412
MAXmalware (ai score=100)
VBA32Trojan.Zpevdo
MalwarebytesTrojan.Downloader
RisingPUF.Pack-Enigma!1.BA33 (CLOUD)
YandexTrojan.Agent!QwBjIYhdqdQ
IkarusPUA.Packed.Enigma
eGambitUnsafe.AI_Score_100%
FortinetW32/Generic!tr
AVGWin32:Malware-gen
PandaTrj/CI.A
CrowdStrikewin/malicious_confidence_80% (D)
MaxSecureTrojan.Malware.7164915.susgen

How to remove Fragtor.16412?

Fragtor.16412 removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment