What is "Graftor.101342"? – Adware Reports

The Graftor.101342 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Graftor.101342 virus can do?

Executable code extraction
A process attempted to delay the analysis task.
Drops a binary and executes it
Unconventionial binary language: Chinese (Simplified)
Unconventionial language used in binary resources: Chinese (Simplified)
The binary likely contains encrypted or compressed data.
Uses Windows utilities for basic functionality
Deletes its original binary from disk
Attempts to repeatedly call a single API many times in order to delay analysis time
Installs itself for autorun at Windows startup
Creates a copy of itself
Anomalous binary characteristics
Uses suspicious command line tools or Windows utilities

Related domains:

xiaolanglang.7766.org

ref.tbfull.com

How to determine Graftor.101342?


File Info:
crc32: 11D51DF1
md5: 1ad63951b4fc8e93e4cf073a3f916ba3
name: Server.exe
sha1: 9d71e6021c9e9f1e2887df9dd335a8691d28b674
sha256: be42233aa6f5bda2868780d0ac21038188748e8666236fbb1b2f1558a6c991f9
sha512: 8fd34425a97a917a942eaec667243a20e391ca43deb3e1f4cc1aa237c97e17410896867c50c5318fea9b6ab4c20924d0412e71ff9d3de906b575d54feb09dadd
ssdeep: 12288:4/tLIrpYYR8uAY6geKUCWycP59h5aAq4TPMOVLycuGPbjl13bZy9zpsNwAW/bgV:MMrpHpNHOVZH3bZ2xAW/bgX2791v
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: x7248x6743x6240x6709 (C) 2004
InternalName: File
FileVersion: 1, 0, 0, 1
CompanyName: 
LegalTrademarks: 
ProductName: File x5e94x7528x7a0bx5e8f
ProductVersion: 1, 0, 0, 1
FileDescription: File Microsoft x57fax7840x7c7bx5e94x7528x7a0bx5e8f
OriginalFilename: File.EXE
Translation: 0x0804 0x04b0

Graftor.101342 also known as:

MicroWorld-eScan	Gen:Variant.Graftor.101342
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic.pak!cobra
BitDefender	Gen:Variant.Graftor.101342
Cybereason	malicious.1b4fc8
BitDefenderTheta	Gen:NN.ZexaF.34106.sr0@auHwYNib
APEX	Malicious
GData	Gen:Variant.Graftor.101342
Endgame	malicious (high confidence)
Emsisoft	Gen:Variant.Graftor.101342 (B)
Invincea	heuristic
Trapmine	malicious.high.ml.score
FireEye	Generic.mg.1ad63951b4fc8e93
SentinelOne	DFI – Malicious PE
MAX	malware (ai score=82)
Arcabit	Trojan.Graftor.D18BDE
ZoneAlarm	HEUR:Backdoor.Win32.Generic
Microsoft	Backdoor:Win32/Zegost.gen!B
ALYac	Gen:Variant.Graftor.101342
eGambit	Unsafe.AI_Score_99%
Ad-Aware	Gen:Variant.Graftor.101342
CrowdStrike	win/malicious_confidence_80% (D)

How to remove Graftor.101342?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

What is “Graftor.101342”?