Categories: Malware

Graftor.288304 removal instruction

The Graftor.288304 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Graftor.288304 virus can do?

Unconventionial language used in binary resources: Russian
The binary contains an unknown PE section name indicative of packing
The binary likely contains encrypted or compressed data.
The executable is compressed using UPX
Authenticode signature is invalid
Attempts to modify proxy settings
Creates a copy of itself
Yara detections observed in process dumps, payloads or dropped files

How to determine Graftor.288304?


File Info:
name: B7D27B7CD44AD807AFF4.mlwpath: /opt/CAPEv2/storage/binaries/5f713ff3bbb9bf7148ac0d1f553032361b4a0b977097b9e188417247d60c72f7crc32: 519F2A58md5: b7d27b7cd44ad807aff4f7700529da6asha1: ddbbf549d949e44431e1e223c1df01f3f1865033sha256: 5f713ff3bbb9bf7148ac0d1f553032361b4a0b977097b9e188417247d60c72f7sha512: 2e51a5c4ae75b988a45a2a4a13943b6d3088f491ffe9d748d43fe981287d142ccca0833a05c8e6d4b0cc13f308eb6accaccc118dc2b5e4eb4572cca19d6ce89bssdeep: 3072:KWRQ/x1lar0WUs/Pb2Etwa9RsTgT2F11bDOr/5KgB5EKC5XOS5pWO:KWWo0WUsHqEtwYyTrF11bD0HB5VC5XO5type: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T19B141202FBF1D634C48B1E3265AF4D6EAB34D5207943475F11A58E0ABDBA20077AF29Dsha3_384: be76866523edfd54ea6330c69876f09c3e9b9d59552e95cc164fd5206251cc8b71336073c7e9814aacfac7b5fae9abc7ep_bytes: 60be005045008dbe00c0faff5783cdfftimestamp: 2010-12-06 10:06:49
Version Info:
CompanyName: Microsoft Office CorporationFileDescription: Microsoft effecxi IxtenXioFileVersion: 1.3.40.2212 (rtm.13)InternalName: effecxi.exeLegalCopyright: © Microsoft Corporation. All rights reserved.OriginalFilename: effecxi.exeProductName: Microsoft® Windows® effecxi IxtenXioProductVersion: 1.3.40.2212Translation: 0x0409 0x04e4

Graftor.288304 also known as:

Elastic	malicious (moderate confidence)
MicroWorld-eScan	Gen:Variant.Graftor.288304
FireEye	Gen:Variant.Graftor.288304
Skyhigh	BehavesLike.Win32.Injector.cc
McAfee	Artemis!B7D27B7CD44A
Cylance	unsafe
Zillya	Trojan.Agent.Win32.120588
CrowdStrike	win/malicious_confidence_90% (D)
Alibaba	TrojanClicker:Win32/MalwareF.c5cb781a
K7GW	Trojan ( 005376ae1 )
K7AntiVirus	Trojan ( 005376ae1 )
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/TrojanClicker.Agent.NGR
Avast	Win32:AdwareX-gen [Adw]
ClamAV	Win.Trojan.Agent-1089015
Kaspersky	Trojan-Clicker.Win32.Agent.qsh
BitDefender	Gen:Variant.Graftor.288304
NANO-Antivirus	Trojan.Win32.Agent.czkgy
Tencent	Win32.Trojan.Agent.Kajl
Sophos	Mal/Generic-S
F-Secure	Trojan.TR/Taranis.4961
DrWeb	Trojan.DownLoad2.16934
VIPRE	Gen:Variant.Graftor.288304
Emsisoft	Gen:Variant.Graftor.288304 (B)
MAX	malware (ai score=100)
Jiangmin	TrojanClicker.Agent.cmt
Webroot	W32.Trojan.Trojan-agent.Gen
Google	Detected
Avira	TR/Taranis.4961
Varist	W32/Risk.PRCB-4230
Antiy-AVL	Trojan[Clicker]/Win32.Agent
Kingsoft	Win32.Troj.AdClicker.a
Microsoft	Trojan:Win32/Sisron
Xcitium	Suspicious@#431ywsepx4kr
Arcabit	Trojan.Graftor.D46630
ZoneAlarm	Trojan-Clicker.Win32.Agent.qsh
GData	Gen:Variant.Graftor.288304
Cynet	Malicious (score: 99)
AhnLab-V3	Trojan/Win32.Agent.C69470
BitDefenderTheta	Gen:NN.ZexaF.36802.lmKfam5Mkumk
ALYac	Gen:Variant.Graftor.288304
VBA32	TrojanClicker.Agent
Panda	Trj/Genetic.gen
Rising	Trojan.Clicker-Agent!8.13 (TFE:5:f5cM7JBmTPD)
Yandex	Trojan.GenAsa!dt/MrqCK2AE
Ikarus	Trojan-Clicker.Win32.Agent
MaxSecure	Trojan.Malware.1550095.susgen
Fortinet	W32/TrojanClicker.TRQ!tr
AVG	Win32:AdwareX-gen [Adw]
DeepInstinct	MALICIOUS
alibabacloud	Trojan[stealer]:Win/Graftor