About “Fugrafa.244173” infection

The Fugrafa.244173 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Fugrafa.244173 virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Dynamic (imported) function loading detected
• Reads data out of its own binary image
• A process created a hidden window
• Drops a binary and executes it
• Unconventionial language used in binary resources: Russian
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• The executable is compressed using UPX
• Authenticode signature is invalid
• Created a process from a suspicious location

How to determine Fugrafa.244173?

File Info:
name: B2AB2E4D1AEC62844E5A.mlw
path: /opt/CAPEv2/storage/binaries/e9926653f721582ba2cd5d763389fe7e2736e6fbe886338b1ff277d9c72114c6
crc32: CCE49A4D
md5: b2ab2e4d1aec62844e5aa6e12ae06949
sha1: cc5a4955e7f56177759b4019fdf44615086e394d
sha256: e9926653f721582ba2cd5d763389fe7e2736e6fbe886338b1ff277d9c72114c6
sha512: ce83bcba479cd824d15754598a907eed8ad6df4df4f42fe19f17b0bf0b60c95a036aa9ca3e5dc53847de042121ecb5b67c32db06a716b38d1393dfb6c16833b5
ssdeep: 196608:gUcMvXv8E0wk3511u0saev2UAt0ExHmFP:/BPv8B1udv2UlTP
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T13C663330955BACBAF952277A3CF86B10FDC16B94DD780CC7B1E515AD8C3AA8D0C52836
sha3_384: 6f9b39d0376c61db8c7608b4e77ff9e42caf2e95dc56888ea772b29c5a65bb3fd82207ff380a49f391fce78896a10467
ep_bytes: 60be008041008dbe0090feff5789e58d
timestamp: 2012-12-31 00:38:51

Version Info:
CompanyName: Oleg N. Scherbakov
FileDescription: 7z Setup SFX (x86)
FileVersion: 1.6.0.2712
InternalName: 7ZSfxMod
LegalCopyright: Copyright © 2005-2012 Oleg N. Scherbakov
OriginalFilename: 7ZSfxMod_x86.exe
PrivateBuild: December 30, 2012
ProductName: 7-Zip SFX
ProductVersion: 1.6.0.2712
Translation: 0x0000 0x04b0

Fugrafa.244173 also known as:

How to remove Fugrafa.244173?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.