Categories: Malware

What is “Graftor.483491”?

The Graftor.483491 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Graftor.483491 virus can do?

Behavioural detection: Executable code extraction – unpacking
Yara rule detections observed from a process memory dump/dropped files/CAPE
CAPE extracted potentially suspicious content
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
Uses Windows utilities for basic functionality
CAPE detected the ZeusPanda malware family
Attempts to identify installed analysis tools by a known file location
Detects the presence of Wine emulator via registry key
Detects Sandboxie using a known mutex
Checks for a known DeepFreeze Frozen State Mutex
Deletes executed files from disk
Collects information to fingerprint the system

How to determine Graftor.483491?


File Info:
name: 37D39B50B9C7E05E6B3E.mlwpath: /opt/CAPEv2/storage/binaries/2dc0c968103328b1b2c7350cb785e3d96568a92a95e7ab8460354ac97dc78099crc32: 5EBB7A4Bmd5: 37d39b50b9c7e05e6b3e56d44678cf6csha1: af2d6d4c5c1bce645b4f46ead1303965f4e34c3bsha256: 2dc0c968103328b1b2c7350cb785e3d96568a92a95e7ab8460354ac97dc78099sha512: 97756e0ec1cd29b9d4e4a71815037257adbfab10513ef39a83e1a2dc6440ea32d2399e153ff1ca5ba11d5d433adc1205cbbae350a76018bc804271987112fd47ssdeep: 6144:B4e9vFebbzfEnh2RZqf6elZcZwDPpMql4hLtbdlJLhCD6VcgSy3b4RMM8:79QTZqZZcKPpM801tkDfgSQ9M8type: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T176946C12F7D4C030F5BA2B70847597755BB67CA19A78824F3BAD7A6E1EB06808C30767sha3_384: 1642ae84260d5c3f9f62d14e459fb752d8c906f3467ae24e59493953a45098f296e1be30c7a11fe837edf76690f4a211ep_bytes: e8fe940000e978feffff6a0c6840a085timestamp: 2018-04-10 01:05:59
Version Info:
FileDescription: Preview Seventh Prescriptin Traits ManifestFileVersion: 2.2.3.315InternalName: RiversLanguages: EnglishComments: Preview Seventh Prescriptin Traits ManifestAssembly Version: 2.2.3.315LegalTrademarks: Copyright ©. calibre-ebook.comCompanyName: calibre-ebook.comPrivateBuild: 2.2.3.315OriginalFilename: RiversLegalCopyright: Copyright ©. calibre-ebook.comProductName: RiversProductVersion: 2.2.3.315Translation: 0x0409 0x04b0

Graftor.483491 also known as:

Bkav	W32.AIDetect.malware2
Lionic	Heuristic.File.Generic.00×1!p
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Graftor.483491
FireEye	Generic.mg.37d39b50b9c7e05e
McAfee	GenericRXFM-UP!37D39B50B9C7
Cylance	Unsafe
Zillya	Trojan.Panda.Win32.189
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Spyware ( 0051fb6b1 )
Alibaba	TrojanSpy:Win32/Panda.ae34e9ac
K7GW	Spyware ( 0051fb6b1 )
CrowdStrike	win/malicious_confidence_100% (W)
BitDefenderTheta	Gen:NN.ZexaF.34646.Aq0@aKqwAGoi
VirIT	Trojan.Win32.Banker.CKT
Cyren	W32/Trojan.YJPQ-1763
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	Win32/Spy.Zbot.ADC
TrendMicro-HouseCall	TSPY_ZBOT.TIBAEBL
Paloalto	generic.ml
ClamAV	Win.Packer.MalwareCrypter-6620810-1
Kaspersky	Trojan-Spy.Win32.Panda.asb
BitDefender	Gen:Variant.Graftor.483491
NANO-Antivirus	Trojan.Win32.Panda.facvuf
Cynet	Malicious (score: 100)
Avast	Win32:Malware-gen
Tencent	Win32.Trojan-Spy.Panda.Uwhl
Ad-Aware	Gen:Variant.Graftor.483491
Sophos	ML/PE-A + Troj/Zbot-MAP
Comodo	Malware@#2h3hp4n0ksc8q
VIPRE	Gen:Variant.Graftor.483491
TrendMicro	TSPY_ZBOT.TIBAEBL
McAfee-GW-Edition	BehavesLike.Win32.Emotet.gh
Trapmine	malicious.high.ml.score
Emsisoft	Gen:Variant.Graftor.483491 (B)
APEX	Malicious
GData	Gen:Variant.Graftor.483491
Jiangmin	TrojanSpy.Panda.hb
Webroot	W32.Malware.Gen
Avira	TR/Crypt.ZPACK.Gen7
MAX	malware (ai score=100)
Antiy-AVL	Trojan/Generic.ASMalwS.49F7
Kingsoft	Win32.Troj.General.lc.(kcloud)
ZoneAlarm	Trojan-Spy.Win32.Panda.asb
Microsoft	Trojan:Win32/Skeeyah.A!rfn
Google	Detected
VBA32	BScope.TrojanSpy.Panda
ALYac	Spyware.Banker.panda
Malwarebytes	MachineLearning/Anomalous.100%
Ikarus	Trojan-Ransom.Crysis
Rising	Trojan.Generic@AI.84 (RDML:XaRjiMERUM7Vtm42Zw3ppQ)
Yandex	TrojanSpy.Panda!/X6FpYdox+w
MaxSecure	Trojan.Malware.12309122.susgen
Fortinet	W32/GenKryptik.CKGB!tr.ransom
AVG	Win32:Malware-gen
Cybereason	malicious.0b9c7e
Panda	Trj/CI.A