About “Fragtor.9406” infection

Malware Removal

The Fragtor.9406 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware - Review 2020

GridinSoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend to use GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the TRIAL period.
6-day free trial available.

What Fragtor.9406 virus can do?

  • Executable code extraction
  • Injection (inter-process)
  • Injection (Process Hollowing)
  • Attempts to connect to a dead IP:Port (1 unique times)
  • Presents an Authenticode digital signature
  • Creates RWX memory
  • A process created a hidden window
  • Performs some HTTP requests
  • The binary likely contains encrypted or compressed data.
  • Looks up the external IP address
  • Executed a process and injected code into it, probably while unpacking
  • Attempts to repeatedly call a single API many times in order to delay analysis time
  • Steals private information from local Internet browsers
  • Collects information about installed applications
  • Checks the CPU name from registry, possibly for anti-virtualization
  • Attempts to access Bitcoin/ALTCoin wallets
  • Harvests information related to installed instant messenger clients
  • Collects information to fingerprint the system
  • Anomalous binary characteristics

Related domains:

api.ipify.org

How to determine Fragtor.9406?


File Info:

crc32: 542164D6
md5: d56c1454ba50e5726df1c1f9cb64c310
name: D56C1454BA50E5726DF1C1F9CB64C310.mlw
sha1: 18e3ff47adbe879d8329d9d614fea679416ac126
sha256: 3ba446e8536427d61e5a46027cf0b60603cc9875fd91df2f3603e6ade817c33f
sha512: 92780f6af372e4055e5180d1047d733d2d138359718c72528e6d6541768def02f00d8de8042b7ba33df8c66359ee58167a9c34d8751f8e5907b9054904b882a1
ssdeep: 6144:tSLlO+SzMZpSIhX+Yrk9upCTOo+jlXPMW0rLAb56dpLN4XQKJrsu:8A+SQpSIDrk9KNPMW0rwrsu
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

InternalName: sagzmeoleke.iwi
ProductVersion: 7.21.22.123
Copyright: Copyrighz (C) 2021, fudkageta
Translation: 0x0122 0x003a

Fragtor.9406 also known as:

K7AntiVirusTrojan ( 0058098a1 )
Elasticmalicious (high confidence)
CynetMalicious (score: 100)
CylanceUnsafe
SangforTrojan.Win32.Save.a
CrowdStrikewin/malicious_confidence_80% (W)
K7GWTrojan ( 0058098a1 )
Cybereasonmalicious.7adbe8
CyrenW32/Kryptik.EWJ.gen!Eldorado
SymantecML.Attribute.HighConfidence
ESET-NOD32a variant of Win32/Kryptik.HMDM
APEXMalicious
AvastWin32:PWSX-gen [Trj]
ClamAVWin.Packed.Pwsx-9862513-0
KasperskyHEUR:Trojan-PSW.Win32.Ficker.gen
BitDefenderGen:Variant.Fragtor.9406
MicroWorld-eScanGen:Variant.Fragtor.9406
Ad-AwareGen:Variant.Fragtor.9406
SophosTroj/Krypt-W
ComodoTrojWare.Win32.Agent.nbsvn@0
BitDefenderThetaGen:NN.ZexaF.34088.Bq3@aqajD8ai
McAfee-GW-EditionArtemis!Trojan
FireEyeGeneric.mg.d56c1454ba50e572
EmsisoftTrojan.Agent (A)
SentinelOneStatic AI – Malicious PE
AviraTR/AD.MalwareCrypter.iynlh
eGambitPE.Heur.InvalidSig
KingsoftWin32.PSWTroj.Undef.(kcloud)
MicrosoftRansom:Win32/StopCrypt.MPK!MTB
GridinsoftRansom.Win32.STOP.ko!se28995
GDataWin32.Trojan.PSE.12ABDG2
AhnLab-V3CoinMiner/Win.Glupteba.R437863
Acronissuspicious
McAfeePacked-GDT!D56C1454BA50
MAXmalware (ai score=83)
VBA32BScope.TrojanRansom.Blocker
MalwarebytesTrojan.MalPack.GS
RisingTrojan.Kryptik!1.D8AC (CLASSIC)
IkarusWin32.Outbreak
MaxSecureTrojan.Malware.300983.susgen
FortinetW32/GenKryptik.FJEX!tr
AVGWin32:PWSX-gen [Trj]

How to remove Fragtor.9406?

Fragtor.9406 removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

Leave a Comment