Categories: Malware

Graftor.128860 removal tips

The Graftor.128860 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Graftor.128860 virus can do?

Attempts to connect to a dead IP:Port (1 unique times)
Yara rule detections observed from a process memory dump/dropped files/CAPE
Creates RWX memory
Dynamic (imported) function loading detected
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid

Related domains:

dns.stressfrei-clan.de

How to determine Graftor.128860?


File Info:
name: F34C42C162B7CC3DDCA5.mlwpath: /opt/CAPEv2/storage/binaries/3159bc0d407af560213cfabeb3b7e8407d1eb2b1d4670abbe3bf630e6e68d9cfcrc32: 26EC776Bmd5: f34c42c162b7cc3ddca54b569e4d920asha1: 64ed097703c024efc1f6caa051979a6767d79d23sha256: 3159bc0d407af560213cfabeb3b7e8407d1eb2b1d4670abbe3bf630e6e68d9cfsha512: 73a52b77c59b2ed3555534d8e8aa389615c7635dd79dde4a2a5aa808489f62348797d64329bb49f71f547974bb14acbbcd35c94b301e0bbb21513d73ab88a52essdeep: 12288:rmtZVh9plxN51BdJFRtZVh9plxN51BdJFR9tZVh9pllxN51BdJFRtZVh9plxN516:vuSBoznA2p4T8EvhWZvfNL2qZWEtqtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1B3E4AE21F3C38537D5631A38AC1B66D959397F202AA86C8B7BF41E4C9F34681391A3D7sha3_384: 523a9257fd113f8e873620d4d9c0fee974b984baef662d98cafd90c5b0a32e646a873ad0da8aaf8f982d4a8978a66507ep_bytes: 558becb9060000006a006a004975f951timestamp: 2014-06-03 20:45:35
Version Info:
0: [No Data]

Graftor.128860 also known as:

Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
CAT-QuickHeal	Backdoor.Nosrawec.S363419
ALYac	Gen:Variant.Graftor.128860
Malwarebytes	Backdoor.PasswordStealer
Zillya	Trojan.SchwarzeSonne.Win32.319
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 7000000f1 )
K7GW	Trojan ( 7000000f1 )
Cybereason	malicious.162b7c
Cyren	W32/Trojan.GLVW-3608
Symantec	SMG.Heur!gen
ESET-NOD32	Win32/SchwarzeSonne.B
APEX	Malicious
ClamAV	Win.Malware.Schwarzesonne-6824322-0
Kaspersky	HEUR:Trojan-Dropper.Win32.Agent.gen
BitDefender	Gen:Variant.Graftor.128860
NANO-Antivirus	Trojan.Win32.SchwarzeSonne.daisiu
MicroWorld-eScan	Gen:Variant.Graftor.128860
Avast	Win32:Nosrawec-A [Spy]
Rising	Backdoor.Win32.Nosrawec.a (CLASSIC)
Ad-Aware	Gen:Variant.Graftor.128860
Emsisoft	Gen:Variant.Graftor.128860 (B)
F-Secure	Trojan.TR/Downloader.Gen
DrWeb	Trojan.MulDrop5.32960
TrendMicro	BKDR_NOSRAWEC.SMJ0
McAfee-GW-Edition	BehavesLike.Win32.Sytro.jh
FireEye	Generic.mg.f34c42c162b7cc3d
Sophos	ML/PE-A + Mal/DelfInj-A
Ikarus	Trojan.Agent
GData	Win32.Backdoor.Agent.ASU
Jiangmin	TrojanDropper.Agent.bqzo
Avira	TR/Downloader.Gen
Antiy-AVL	Trojan/Generic.ASMalwS.A4364F
Arcabit	Trojan.Graftor.D1F75C
Microsoft	Backdoor:Win32/Nosrawec.A
TACHYON	Trojan-Spy/W32.DP-Recam.693248
AhnLab-V3	Spyware/Win.Recam.R448762
Acronis	suspicious
McAfee	GenericRXEQ-YO!F34C42C162B7
MAX	malware (ai score=89)
VBA32	BScope.Trojan.Sabsik.FL
Cylance	Unsafe
TrendMicro-HouseCall	BKDR_NOSRAWEC.SMJ0
Tencent	Malware.Win32.Gencirc.10b22c02
SentinelOne	Static AI – Malicious PE
Fortinet	W32/SchwarzeSonne.B!tr
BitDefenderTheta	AI:Packer.01152FC821
AVG	Win32:Nosrawec-A [Spy]
Panda	Trj/Genetic.gen
CrowdStrike	win/malicious_confidence_90% (D)
MaxSecure	Trojan.Malware.300983.susgen