About “Fugrafa.135201” infection

Malware Removal

The Fugrafa.135201 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware - Review 2020

GridinSoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend to use GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the TRIAL period.
6-day free trial available.

What Fugrafa.135201 virus can do?

  • Executable code extraction
  • Injection (inter-process)
  • Injection (Process Hollowing)
  • Injection with CreateRemoteThread in a remote process
  • Attempts to connect to a dead IP:Port (2 unique times)
  • Creates RWX memory
  • A process created a hidden window
  • Performs some HTTP requests
  • Unconventionial language used in binary resources: Uzbek (Cyrillic)
  • The binary likely contains encrypted or compressed data.
  • Looks up the external IP address
  • Executed a process and injected code into it, probably while unpacking
  • Attempts to repeatedly call a single API many times in order to delay analysis time
  • Steals private information from local Internet browsers
  • Collects information about installed applications
  • Checks the CPU name from registry, possibly for anti-virtualization
  • Attempts to modify proxy settings
  • Attempts to access Bitcoin/ALTCoin wallets
  • Collects information to fingerprint the system
  • Anomalous binary characteristics

Related domains:

z.whorecord.xyz
a.tomx.xyz
api.ipify.org
gurums.link

How to determine Fugrafa.135201?


File Info:

crc32: 7C9862A5
md5: e3d5e71554ea9c71784be32fb7503ffa
name: E3D5E71554EA9C71784BE32FB7503FFA.mlw
sha1: a1dc07d5001de3f85dd39d4243e3c436a3ff6ae1
sha256: 7eae58eccff01d16d5d64cc13b4c59370ae6d998543888d198a4415f46525561
sha512: 3b7a9212bdb78d2a158491b0870c9327de704338fb73ce2f2c011f46b8b92f14ffe47d991026fbc7297dac910568a7bfa4b4785a3287c06579f26cbb1104816a
ssdeep: 6144:/LW+E+R5ZMhpEWHaFTJUMt1rJ4JGbNLv4KNN:/K+E+R5GEWWTJT1SQNb46N
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

LegalCopyrighd: Wsekde
InternalNames: galimatimot
FileVersion: 7.0.2.54
ProductVersion: 7.0.21.21
Translations: 0x0148 0x1823

Fugrafa.135201 also known as:

BkavW32.AIDetect.malware1
Elasticmalicious (high confidence)
CynetMalicious (score: 100)
CylanceUnsafe
SangforTrojan.Win32.Save.a
CrowdStrikewin/malicious_confidence_100% (W)
Cybereasonmalicious.5001de
SymantecML.Attribute.HighConfidence
ESET-NOD32a variant of Win32/Kryptik.HKQO
APEXMalicious
AvastFileRepMetagen [Malware]
KasperskyHEUR:Backdoor.Win32.Androm.gen
BitDefenderGen:Variant.Fugrafa.135201
MicroWorld-eScanGen:Variant.Fugrafa.135201
Ad-AwareGen:Variant.Fugrafa.135201
SophosML/PE-A
BitDefenderThetaGen:NN.ZexaF.34686.ry1@aCEhyeoO
FireEyeGeneric.mg.e3d5e71554ea9c71
SentinelOneStatic AI – Malicious PE
AviraTR/Crypt.XPACK.Gen2
MicrosoftTrojan:Win32/Glupteba.PU!MTB
Acronissuspicious
MAXmalware (ai score=86)
MalwarebytesTrojan.MalPack.GS
RisingMalware.Heuristic!ET#92% (RDMK:cmRtazq4x507VIjSSg9B/XlACvxG)
FortinetW32/Kryptik.HKQK!tr
AVGFileRepMetagen [Malware]

How to remove Fugrafa.135201?

Fugrafa.135201 removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

Leave a Comment