Categories: Malware

Graftor.139313 removal guide

The Graftor.139313 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Graftor.139313 virus can do?

Behavioural detection: Executable code extraction – unpacking
Sample contains Overlay data
Performs HTTP requests potentially not found in PCAP.
Reads data out of its own binary image
CAPE extracted potentially suspicious content
Unconventionial language used in binary resources: Chinese (Simplified)
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
Behavioural detection: Injection (Process Hollowing)
Behavioural detection: Injection (inter-process)
Attempts to modify proxy settings
Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Graftor.139313?


File Info:
name: 9F3981A6DBAF727B8BE9.mlwpath: /opt/CAPEv2/storage/binaries/51eaf8312dfa34baaecafce429be1af05ef97ffd030658591aa9e3e88a897848crc32: 4C30CE52md5: 9f3981a6dbaf727b8be9fcaf71641a11sha1: c846b77586432a68decad1ef7f2ebaaa1307fba8sha256: 51eaf8312dfa34baaecafce429be1af05ef97ffd030658591aa9e3e88a897848sha512: ea55412f8a8be1ae85add44d62ac0644ab8fc5370032fb68ae74b4c321f34e246cdc33b3bd6317fdc730999b976540533b7019be81450f55ee0a065940a4d862ssdeep: 1536:Yh0RN3G789W/NALgqVV36LcObOFHoCJTfGdHYjBZSap3h+b:YW6/NALgi8cObOFBf2HYeq3h+btype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1CF939D4A821281D8D62F8871ECE326FCF7DABDA64F826A77EF4CD90F51365805D2051Esha3_384: 7bcbde7be204fbd3082ba2f3d4ecb2ac0fc52bb17e6f1e78eb6610e2accb150993faa666bea3c62e65a4612abd282d3cep_bytes: 558bec6aff68185c400068484a400064timestamp: 2014-04-15 16:36:49
Version Info:
0: [No Data]

Graftor.139313 also known as:

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Generic.4!c
tehtris	Generic.Malware
DrWeb	Trojan.Winlock.9017
MicroWorld-eScan	Gen:Variant.Graftor.139313
FireEye	Generic.mg.9f3981a6dbaf727b
CAT-QuickHeal	TrojanDownloader.Upatre.A4
Skyhigh	BehavesLike.Win32.Generic.nc
McAfee	Downloader-FYH!9F3981A6DBAF
VIPRE	Gen:Variant.Graftor.139313
K7AntiVirus	Trojan ( 0055e3991 )
BitDefender	Gen:Variant.Graftor.139313
K7GW	Trojan ( 0055e3991 )
Cybereason	malicious.586432
BitDefenderTheta	Gen:NN.ZexaF.36792.fqX@aO5rtypb
VirIT	Trojan.Win32.Inject2.AAUW
Symantec	Trojan.Cidox!gm
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/Injector.BCCJ
APEX	Malicious
Kaspersky	HEUR:Trojan.Win32.Generic
Alibaba	Trojan:Win32/DllCheck.bb737376
NANO-Antivirus	Trojan.Win32.Zbot.cwlwzr
Rising	Stealer.Zbot!8.109D7 (TFE:5:v5KQTpNadnF)
Sophos	Mal/Zbot-QT
F-Secure	Trojan.TR/Crypt.XPACK.Gen7
Zillya	Trojan.Zbot.Win32.156982
TrendMicro	TROJ_MALKRYP.SM1
Trapmine	malicious.high.ml.score
Emsisoft	Gen:Variant.Graftor.139313 (B)
SentinelOne	Static AI – Suspicious PE
MAX	malware (ai score=100)
Jiangmin	Trojan/Generic.bedbg
Webroot	W32.Trojan.Gen
Google	Detected
Avira	TR/Crypt.XPACK.Gen7
Varist	W32/ZbotP.G
Antiy-AVL	Trojan[Ransom]/Win32.PornoAsset
Kingsoft	malware.kb.a.997
Microsoft	Trojan:Win32/DllCheck.A!MSR
Xcitium	Malware@#2ued19xv9zrcq
Arcabit	Trojan.Graftor.D22031
ZoneAlarm	HEUR:Trojan.Win32.Generic
GData	Gen:Variant.Graftor.139313
Cynet	Malicious (score: 100)
ALYac	Gen:Variant.Graftor.139313
DeepInstinct	MALICIOUS
VBA32	TrojanSpy.Zbot
Cylance	unsafe
Panda	Trj/Genetic.gen
TrendMicro-HouseCall	TROJ_MALKRYP.SM1
Tencent	Malware.Win32.Gencirc.114e546b
Yandex	TrojanSpy.Zbot!DV3mgE65PoE
Ikarus	Trojan.Win32.Injector
MaxSecure	Trojan.Malware.7052413.susgen
Fortinet	W32/Kryptik.WIF!tr
AVG	Win32:Inject-BIC [Trj]
Avast	Win32:Inject-BIC [Trj]
CrowdStrike	win/malicious_confidence_100% (D)