Should I remove “Fragtor.56689”?

The Fragtor.56689 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Fragtor.56689 virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Behavioural detection: Executable code extraction – unpacking
• Executed a command line with /C or /R argument to terminate command shell on completion which can be used to hide execution
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Possible date expiration check, exits too soon after checking local time
• Dynamic (imported) function loading detected
• Reads data out of its own binary image
• A process created a hidden window
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• Unconventionial language used in binary resources: Macedonian
• Authenticode signature is invalid
• Uses Windows utilities for basic functionality
• Enumerates services, possibly for anti-virtualization
• Behavioural detection: Injection (Process Hollowing)
• Executed a process and injected code into it, probably while unpacking
• Deletes its original binary from disk
• Behavioural detection: Injection (inter-process)
• Installs itself for autorun at Windows startup
• Installs itself for autorun at Windows startup
• CAPE detected the Tofsee malware family
• Attempts to interact with an Alternate Data Stream (ADS)
• Anomalous binary characteristics
• Uses suspicious command line tools or Windows utilities

How to determine Fragtor.56689?

File Info:
name: 4A47DE0BA351533F7375.mlw
path: /opt/CAPEv2/storage/binaries/5e1893f5be178ac451a6b4b75802b35a3dae233c11b3d9a7d39cc07188506f7d
crc32: AF6F5185
md5: 4a47de0ba351533f7375052571a3b886
sha1: 35aee8fd889c023510eb91a312d2a8fc2a81c65f
sha256: 5e1893f5be178ac451a6b4b75802b35a3dae233c11b3d9a7d39cc07188506f7d
sha512: cb57852ff1cd23032c21a44290306a6a0df7e2fe88d8c692633c4ea696a4c85201d674f25310116514d9b8e22a63924c4731b2c4c2165e367206f249bc1c0a79
ssdeep: 6144:WHzU1O1D5PuzNsDDaM+2Hor7464646464646464646464646464646464646464H:WTU1GgNsSM+2o
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1F6D6C582A7E4D826F6F70A74557542D92977FCD6A924818FF0683F1B38B22C16DB0723
sha3_384: 2947da027fbea85bb529094f131ca76fb96182a950e7811f9f8a751482717c7ec1e7e488de7faeb30717b46f4cee24de
ep_bytes: e8ff640000e978feffffcccccccccccc
timestamp: 2021-04-01 23:08:40

Version Info:
FileVers: 65.51.36.16
ProductVersa: 7.50.25.71
InternalName: peatemas
LegalCopyrighd: sharnir
Translations: 0x0169 0x0300

Fragtor.56689 also known as:

How to remove Fragtor.56689?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.