Categories: Malware

About “Graftor.372539” infection

The Graftor.372539 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Graftor.372539 virus can do?

Sample contains Overlay data
Presents an Authenticode digital signature
Performs HTTP requests potentially not found in PCAP.
Drops a binary and executes it
Unconventionial language used in binary resources: Arabic (Saudi Arabia)
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid
Attempts to modify proxy settings
Attempts to interact with an Alternate Data Stream (ADS)

How to determine Graftor.372539?


File Info:
name: CE77F54E242025816355.mlwpath: /opt/CAPEv2/storage/binaries/d8c3f2ff783cc04ca179cceee0d951674927a5e65e4d60d7b62d73183899e1f0crc32: 953F349Dmd5: ce77f54e242025816355e332952de1bbsha1: 2285b7bf86f147a085f06ea42996ea0a0bd6e16asha256: d8c3f2ff783cc04ca179cceee0d951674927a5e65e4d60d7b62d73183899e1f0sha512: f7da8361dc5cd4ff6ece37fc79d4532a81e60bfd780e4468f4d9b761dca0cb57d337f925e1da9ae86cd7731c51dc10a4abd69bcd5a76c1e3dafa551b38858e6essdeep: 49152:gKe+YtRcfmgsieYTUamo98K8CLcE0grvhoY1ug:qxteqcHc1g9oYttype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T162061700E640C129D8E761BDAAED6128681CEDDF171391C7718726EBAA35EFC3D3419Esha3_384: 050371bd7a0d9042237433b5e883703d70deab776098081c9fc763dcaadef5d0d6b4a95e0a5c0718e2df10f48b37617fep_bytes: e97c511400e947520a00e9f2160600e9timestamp: 2017-02-26 08:13:02
Version Info:
CompanyName: TODO: FileDescription: TODO: FileVersion: 1.0.0.1InternalName: testproj.exeLegalCopyright: TODO: (c) .  All rights reserved.OriginalFilename: testproj.exeProductName: TODO: ProductVersion: 1.0.0.1Translation: 0x0409 0x04e4

Graftor.372539 also known as:

Elastic	malicious (moderate confidence)
DrWeb	Trojan.Click3.23743
MicroWorld-eScan	Gen:Variant.Graftor.372539
FireEye	Generic.mg.ce77f54e24202581
ALYac	Gen:Variant.Graftor.372539
VIPRE	Gen:Variant.Graftor.372539
K7AntiVirus	Trojan ( 004fa1541 )
BitDefender	Gen:Variant.Graftor.372539
K7GW	Trojan ( 004fa1541 )
Cybereason	malicious.e24202
Arcabit	Trojan.Graftor.D5AF3B
Symantec	Trojan.Kasperbogi
ESET-NOD32	a variant of Win32/Kasperagent.E.gen
APEX	Malicious
ClamAV	Win.Malware.Johnnie-9958146-0
Kaspersky	HEUR:Trojan.Win32.Generic
NANO-Antivirus	Trojan.Win32.Agent.elzanb
Rising	Malware.FakeXLS/ICON!1.9C3D (CLASSIC)
Ad-Aware	Gen:Variant.Graftor.372539
Zillya	Trojan.Snojan.Win32.15
McAfee-GW-Edition	GenericR-JIU!CB336CEA05EF
Emsisoft	Trojan-PSW.Agent (A)
Jiangmin	Trojan.Generic.hdejo
Google	Detected
Avira	TR/KAgent.rwsih
MAX	malware (ai score=86)
Antiy-AVL	Trojan/Generic.ASMalwS.2D
Microsoft	Trojan:Win32/Wacatac.B!ml
GData	Gen:Variant.Graftor.372539
AhnLab-V3	Trojan/Win32.RL_DOTHETUK.R331398
McAfee	GenericR-JIU!CB336CEA05EF
VBA32	Backdoor.Spy
Malwarebytes	Malware.AI.1573129850
Panda	Trj/GdSda.A
Tencent	Malware.Win32.Gencirc.12026223
Yandex	Trojan.GenAsa!GEr0bUMG0VM
Ikarus	Trojan.Agent
Fortinet	W32/Agent.YJA!tr
AVG	Win32:Malware-gen
Avast	Win32:Malware-gen