Malware

Graftor.315286 information

Malware Removal

The Graftor.315286 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Graftor.315286 virus can do?

  • Executable code extraction
  • Unconventionial binary language: Chinese (Simplified)
  • Unconventionial language used in binary resources: Chinese (Simplified)
  • The binary likely contains encrypted or compressed data.
  • Deletes its original binary from disk
  • Creates a copy of itself
  • Created a service that was not started
  • Anomalous binary characteristics

Related domains:

z.whorecord.xyz
a.tomx.xyz

How to determine Graftor.315286?


File Info:

crc32: 5ED5A7A4
md5: 6b0478e22e6fd5856aa0050d5dee6ab9
name: web5.exe
sha1: ac6b76ba7475b461ea13d5c431998e5db82175fe
sha256: d160c8898898478b29e20cc68c3b6a858493904c5d222ff746989ef91fdfb3df
sha512: f1c4c0ddb573cf674b0b71b9bb672066df7aef733fe609d755e743128eb18dadb6c7de8469daa7b36a03f6e64516734ed2784efe64f449e3e60c3aa4d483fd37
ssdeep: 1536:AlbCGz1zTo10PqqZlaS26PIW+kHe17u8zgsUop+G8b:ZgM09PAh7bUsVcG8b
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

LegalCopyright: x7248x6743x6240x6709 (C) 2006
InternalName: GetAirReport
FileVersion: 1, 0, 0, 1
CompanyName:
LegalTrademarks:
ProductName: GetAirReport x5e94x7528x7a0bx5e8f
ProductVersion: 1, 0, 0, 1
FileDescription: GetAirReport Microsoft x57fax7840x7c7bx5e94x7528x7a0bx5e8f
OriginalFilename: GetAirReport.EXE
Translation: 0x0804 0x04b0

Graftor.315286 also known as:

MicroWorld-eScanGen:Variant.Graftor.315286
ALYacGen:Variant.Graftor.315286
CylanceUnsafe
VIPRETrojan.Win32.Generic!BT
SangforMalware
K7AntiVirusBackdoor ( 0056548f1 )
BitDefenderGen:Variant.Graftor.315286
K7GWBackdoor ( 0056548f1 )
CrowdStrikewin/malicious_confidence_100% (W)
SymantecML.Attribute.HighConfidence
APEXMalicious
GDataGen:Variant.Graftor.315286
KasperskyBackdoor.Win32.Lotok.byw
AlibabaBackdoor:Win32/Zegost.347579dc
AegisLabTrojan.Multi.Generic.4!c
RisingBackdoor.Zegost!8.177 (CLOUD)
Ad-AwareGen:Variant.Graftor.315286
EmsisoftGen:Variant.Graftor.315286 (B)
F-SecureTrojan.TR/Kryptik.trcok
Invinceaheuristic
McAfee-GW-EditionRDN/Generic BackDoor
FireEyeGeneric.mg.6b0478e22e6fd585
SophosMal/Generic-S
IkarusTrojan.Win32.Krypt
AviraTR/Kryptik.trcok
MAXmalware (ai score=99)
Endgamemalicious (high confidence)
ArcabitTrojan.Graftor.D4CF96
ZoneAlarmBackdoor.Win32.Lotok.byw
MicrosoftBackdoor:Win32/Zegost.BW
Acronissuspicious
McAfeeRDN/Generic BackDoor
VBA32BScope.Trojan.Dynamer
PandaTrj/GdSda.A
ESET-NOD32a variant of Win32/GenKryptik.EHYK
TrendMicro-HouseCallTROJ_GEN.R049C0DES20
SentinelOneDFI – Suspicious PE
FortinetW32/GenKryptik.EHYK!tr
BitDefenderThetaGen:NN.ZexaF.34122.fq0@aycxvxcb
AVGFileRepMalware
Cybereasonmalicious.22e6fd
Paloaltogeneric.ml

How to remove Graftor.315286?

Graftor.315286 removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment