Fragtor.44186 malicious file

The Fragtor.44186 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Fragtor.44186 virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Behavioural detection: Executable code extraction – unpacking
• Executed a command line with /C or /R argument to terminate command shell on completion which can be used to hide execution
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Dynamic (imported) function loading detected
• Reads data out of its own binary image
• A process created a hidden window
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• Unconventionial language used in binary resources: Latvian
• Authenticode signature is invalid
• Uses Windows utilities for basic functionality
• Enumerates services, possibly for anti-virtualization
• Behavioural detection: Injection (Process Hollowing)
• Executed a process and injected code into it, probably while unpacking
• Deletes its original binary from disk
• Behavioural detection: Injection (inter-process)
• Installs itself for autorun at Windows startup
• Installs itself for autorun at Windows startup
• CAPE detected the Tofsee malware family
• Attempts to interact with an Alternate Data Stream (ADS)
• Anomalous binary characteristics
• Uses suspicious command line tools or Windows utilities

How to determine Fragtor.44186?

File Info:
name: 3A68CACB5011973D4721.mlw
path: /opt/CAPEv2/storage/binaries/e891322e5d046f40638d60d064393aaaab2217db1da87cae6f08f9befa5db645
crc32: B7A7F963
md5: 3a68cacb5011973d47217ef86f5bc4e1
sha1: 99545a1f41466693ba0b0aebf931f3a08a0845d4
sha256: e891322e5d046f40638d60d064393aaaab2217db1da87cae6f08f9befa5db645
sha512: 6071466050b8cce1695b277df04aff96a7d687833c2c1dd943af74557da038e48bd8fe96446f2ebf163de5eb2aba205e6153281162cdf8f1d884f29103b222ca
ssdeep: 24576:hWwUGYJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJ5:h
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T149B65BD16EEB42CDFAE75A300871AE9456F7BDA6A930415F24C0E12F1D71B8089E3763
sha3_384: 6913a35261ba5cef85772a3265dac67a581679202872420040ea6061487279cbed87b81e154b71fec9202a85fa93c21e
ep_bytes: e8d02a0000e989feffff8bff558bec68
timestamp: 2020-12-27 11:46:19

Version Info:
InternalName: bomgpiaruci.iwa
Copyright: Copyrighz (C) 2021, fudkat
ProductVersion: 13.54.77.25
Translation: 0x0114 0x046a

Fragtor.44186 also known as:

How to remove Fragtor.44186?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.