Malware

Fragtor.27746 (B) removal guide

Malware Removal

The Fragtor.27746 (B) is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Fragtor.27746 (B) virus can do?

  • Executable code extraction
  • Injection (inter-process)
  • Injection (Process Hollowing)
  • Creates RWX memory
  • A process attempted to delay the analysis task.
  • A named pipe was used for inter-process communication
  • A process created a hidden window
  • Drops a binary and executes it
  • Performs some HTTP requests
  • Unconventionial language used in binary resources: Hungarian
  • The binary likely contains encrypted or compressed data.
  • Executed a process and injected code into it, probably while unpacking
  • Network activity contains more than one unique useragent.
  • Installs itself for autorun at Windows startup
  • Writes a potential ransom message to disk
  • Attempts to modify proxy settings
  • Creates a copy of itself
  • Uses suspicious command line tools or Windows utilities

Related domains:

z.whorecord.xyz
api.2ip.ua
a.tomx.xyz
znpst.top
securebiz.org
mas.to

How to determine Fragtor.27746 (B)?


File Info:

crc32: 5297A1AB
md5: bcde98091f5f9b6640ed56f2e55c19be
name: BCDE98091F5F9B6640ED56F2E55C19BE.mlw
sha1: 300d73b6d7d1da027a902e2b3ec3e0e6294c2618
sha256: af35e03096a46efba0066c0af0b3d2b065182e0e860c0a3bef5212eefb945500
sha512: c3f2fcd9c4301a28ba309bbca40f929e739c9ce73c8fb6ca73aa2e07fa7391c0f87974aa561b30de36f3fc9d8565b5edac459d0fa3903bbaddf0cde861792eaf
ssdeep: 12288:9bnBsdIIU9HXoYyk4ZjKU4DzJ77o4LM6LvcRUr36+MBdNV2hhJvXPb7L6qFzxd6:9Ky3N6oU4DzF7Ls1B4zvXPvhL6L
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

InternalName: sajbmianozu.iya
ProductVersion: 8.64.59.52
Copyright: Copyrighz (C) 2021, fudkagat
Translation: 0x0527 0x007a

Fragtor.27746 (B) also known as:

Elasticmalicious (high confidence)
ALYacGen:Variant.Fragtor.27746
CylanceUnsafe
SangforTrojan.Win32.Save.a
CrowdStrikewin/malicious_confidence_100% (D)
CyrenW32/Kryptik.EWJ.gen!Eldorado
SymantecML.Attribute.HighConfidence
ESET-NOD32a variant of Win32/Kryptik.HMSC
APEXMalicious
AvastWin32:MalwareX-gen [Trj]
CynetMalicious (score: 100)
KasperskyHEUR:Trojan.Win32.Strab.gen
BitDefenderGen:Variant.Fragtor.27746
MicroWorld-eScanGen:Variant.Fragtor.27746
Ad-AwareGen:Variant.Fragtor.27746
SophosML/PE-A + Troj/Krypt-CY
BitDefenderThetaGen:NN.ZexaF.34170.Zq0@aCOyWokO
McAfee-GW-EditionBehavesLike.Win32.Lockbit.cc
FireEyeGeneric.mg.bcde98091f5f9b66
EmsisoftGen:Variant.Fragtor.27746 (B)
SentinelOneStatic AI – Malicious PE
MicrosoftRansom:Win32/StopCrypt.MJK!MTB
ArcabitTrojan.Fragtor.D6C62
GDataGen:Variant.Fragtor.27746
AhnLab-V3Infostealer/Win.SmokeLoader.R443617
Acronissuspicious
McAfeeRDN/Generic.grp
MAXmalware (ai score=84)
MalwarebytesTrojan.MalPack.GS
PandaTrj/GdSda.A
Rising[email protected] (RDML:+QQElt7uZWJJEq6Hj5+PsQ)
IkarusTrojan-Banker.UrSnif
FortinetW32/Kryptik.HMSC!tr
AVGWin32:MalwareX-gen [Trj]

How to remove Fragtor.27746 (B)?

Fragtor.27746 (B) removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment