About “Fugrafa.251293 (B)” infection

The Fugrafa.251293 (B) is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Fugrafa.251293 (B) virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Possible date expiration check, exits too soon after checking local time
• Dynamic (imported) function loading detected
• Performs HTTP requests potentially not found in PCAP.
• Reads data out of its own binary image
• A process created a hidden window
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• The binary contains an unknown PE section name indicative of packing
• Executable file is packed/obfuscated with MPRESS
• Authenticode signature is invalid
• Attempts to repeatedly call a single API many times in order to delay analysis time
• Created a process from a suspicious location
• Attempts to modify proxy settings
• Anomalous binary characteristics

How to determine Fugrafa.251293 (B)?

File Info:
name: F4681C61CB2B94CC3104.mlw
path: /opt/CAPEv2/storage/binaries/9c1e2a78da16080110fbcc0e27bf468f879edb93bac31f799d4fdb1f023711ef
crc32: A1EFB0AE
md5: f4681c61cb2b94cc31048624970993d4
sha1: d821d51b0efffe680f9130c3972b764615fcd7ae
sha256: 9c1e2a78da16080110fbcc0e27bf468f879edb93bac31f799d4fdb1f023711ef
sha512: 7ce185601b0ef23653dc972275688578d8d96196c758e27aee768101512e299b256961872064a5a5d7c25bd47b8ab29cb8b482f697aa3b9d47d6ded6ca36c888
ssdeep: 384:TgEaziQIBt8yguzjEBNQiviL//U8zYpDc7+57ERk95Wk+:T7a/6BlSvW//pzW7hEk+
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T17DA33BF33ECDDF2EF13EDEB548B4D0EA6C21791488A2002D7584A84F1C662979DED615
sha3_384: 65b6298728bfabf949d0bdbd362b29ba52dc6f69d47f14917f7f7e38385e906f744106b243bc48396ca050341ba58f6c
ep_bytes: 837c24120ae8b6ffffff29d101c1e889
timestamp: 2004-05-28 09:53:59

Version Info:
0: [No Data]

Fugrafa.251293 (B) also known as:

How to remove Fugrafa.251293 (B)?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.