Malware

Fragtor.3314 removal tips

Malware Removal

The Fragtor.3314 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware - Review 2020

GridinSoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend to use GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the TRIAL period.
6-day free trial available.

What Fragtor.3314 virus can do?

  • Executable code extraction
  • Injection (inter-process)
  • Injection (Process Hollowing)
  • Possible date expiration check, exits too soon after checking local time
  • Creates RWX memory
  • A process attempted to delay the analysis task.
  • Attempts to connect to a dead IP:Port (20 unique times)
  • At least one IP Address, Domain, or File Name was found in a crypto call
  • A named pipe was used for inter-process communication
  • Starts servers listening on 0.0.0.0:0
  • Expresses interest in specific running processes
  • Reads data out of its own binary image
  • A process created a hidden window
  • Drops a binary and executes it
  • HTTP traffic contains suspicious features which may be indicative of malware related traffic
  • Performs some HTTP requests
  • Looks up the external IP address
  • Executed a very long command line or script command which may be indicative of chained commands or obfuscation
  • A scripting utility was executed
  • Uses Windows utilities for basic functionality
  • Executed a process and injected code into it, probably while unpacking
  • Detects Sandboxie through the presence of a library
  • Detects Avast Antivirus through the presence of a library
  • Detects VirtualBox using WNetGetProviderName trick
  • Checks for the presence of known windows from debuggers and forensic tools
  • Steals private information from local Internet browsers
  • Network activity contains more than one unique useragent.
  • Installs itself for autorun at Windows startup
  • Creates a hidden or system file
  • Checks the version of Bios, possibly for anti-virtualization
  • Detects VirtualBox through the presence of a registry key
  • Attempts to disable Windows Defender
  • Attempts to create or modify system certificates
  • Collects information to fingerprint the system
  • Uses suspicious command line tools or Windows utilities

Related domains:

hsiens.xyz
a.goatgame.co
safialinks.com
cdn.discordapp.com
lenko349.tumblr.com
ocsp.digicert.com
ipinfo.io
i.spesgrt.com
aa.goatgamea.com
eurekabike.com
privacytoolz123foryou.xyz
2551889d-a2db-4908-a9a2-6b0fab0a7a78.s3.eu-west-2.amazonaws.com
manager4youdrivers.ru
apps.identrust.com
telegram.org
crl.identrust.com
twitter.com
yandex.ru
cleaner-partners.biz
ocsp.comodoca.com
crl.comodoca.com
crl3.digicert.com
crl4.digicert.com
iplis.ru
romkaxarit.tumblr.com
sf.symcd.com
ocsp.usertrust.com
crl.usertrust.com
ocsp.sectigo.com
iplogger.org
s2.symcb.com
g.symcd.com
g2.symcb.com
ocsp.omniroot.com
ocsp.verisign.com
ss.symcd.com

How to determine Fragtor.3314?


File Info:

crc32: AC74379C
md5: 0a313a73aac1905c6ef571c4e700554a
name: 0A313A73AAC1905C6EF571C4E700554A.mlw
sha1: 7f2e2d4656ae4a5e6015c51184e19ef26510fb12
sha256: f25e4213555bb2e557f66fb99d91a03972c1882ca8c2ac8748e25fc09798e2be
sha512: b8323f01a915c1e28d9926a07518c798546ab12aa8d8c1038c9f18973beab78fda972aaea1b7a0814b6c3efa0847ee2f89ccc3abfa8bcc239eb12a36a069b576
ssdeep: 98304:xorRBQQyUroZi+nTf55/2UJ70UsjVk+io3McLpN3SQXB/uz7h4sWsjFe5qx:xorR3rETfjB70Ush9io3MeDOl4sW8+qx
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

LegalCopyright: Copyright (c) 1999-2018 Igor Pavlov
InternalName: 7zS.sfx
FileVersion: 19.00
CompanyName: Igor Pavlov
ProductName: 7-Zip
ProductVersion: 19.00
FileDescription: 7z Setup SFX
OriginalFilename: 7zS.sfx.exe
Translation: 0x0409 0x04b0

Fragtor.3314 also known as:

ClamAVWin.Packed.Jaik-9863991-0
ALYacGen:Variant.Fragtor.3314
CylanceUnsafe
ESET-NOD32a variant of Win32/TrojanDropper.Agent.SOL
AvastWin32:Malware-gen
CynetMalicious (score: 100)
BitDefenderGen:Variant.Fragtor.3314
MicroWorld-eScanGen:Variant.Fragtor.3314
BitDefenderThetaGen:NN.ZedlaF.34126.e84baGUd!Jh
McAfee-GW-EditionBehavesLike.Win32.Generic.tc
FireEyeGen:Variant.Fragtor.3314
EmsisoftGen:Variant.Fragtor.3314 (B)
MicrosoftTrojan:Win32/Azorult!ml
ArcabitTrojan.Fragtor.DCF2
GDataGen:Variant.Fragtor.3314
MAXmalware (ai score=86)
MalwarebytesTrojan.Downloader.Generic
FortinetW32/AgentDropper.SOL!tr
AVGWin32:Malware-gen

How to remove Fragtor.3314?

Fragtor.3314 removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment