Malware

What is “Graftor.519151”?

Malware Removal

The Graftor.519151 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Graftor.519151 virus can do?

  • Executable code extraction
  • Attempts to connect to a dead IP:Port (2 unique times)
  • Creates RWX memory
  • HTTP traffic contains suspicious features which may be indicative of malware related traffic
  • Performs some HTTP requests
  • The binary likely contains encrypted or compressed data.
  • The executable is compressed using UPX
  • Queries information on disks, possibly for anti-virtualization
  • Detects the presence of Wine emulator via registry key
  • Checks the version of Bios, possibly for anti-virtualization
  • Attempts to modify proxy settings
  • Collects information to fingerprint the system

Related domains:

z.whorecord.xyz
a.tomx.xyz
static.16.249.201.195.clients.your-server.de

How to determine Graftor.519151?


File Info:

crc32: 17BFD11B
md5: 8c41c44d39fac7fa077f8a3ff28f1caa
name: 8C41C44D39FAC7FA077F8A3FF28F1CAA.mlw
sha1: c6ce6ee22c60c2c8b3643deab5e2134c33ff6079
sha256: 217d9bdcfc796c2b1e01e154137e0e05e9ab184a0d75c63d6a5db1b68b473247
sha512: a53f99031e4dce416c7a06aed029f076332e4c9cd7261eb73f0f8d9d714d78374a9819f784c74f59b252965282e56f3cc917a3755ac3ca53ceb4ccdb89b3920c
ssdeep: 49152:Dq4vD3G3kb4iUQTuKb6VkA2HoWyR+UMVy2EyR4h4UpwfxFHvAPeVAkak73EoxN:24vD2304CTFGV/2oWyMUmbEyChBpWAP8
type: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed

Version Info:

InternalName: XRepair.exe
FileVersion: 14.0.1056.2
ProductName: NET Components 4.53 free installer
ProductVersion: 14.0.1056.2
FileDescription: NET Components 4.53 Setup
OriginalFilename: XRepair.exe
Translation: 0x0409 0x04b0

Graftor.519151 also known as:

BkavW32.AIDetect.malware2
K7AntiVirusTrojan ( 0053ce971 )
Elasticmalicious (high confidence)
DrWebTrojan.InstallCube.3673
CynetMalicious (score: 100)
CAT-QuickHealTrojan.EkstakPMF.S3744104
ALYacGen:Variant.Graftor.519151
CylanceUnsafe
ZillyaTrojan.Generic.Win32.68648
AlibabaTrojan:Win32/Katusha.c6de60c0
K7GWTrojan ( 0053ce971 )
Cybereasonmalicious.d39fac
SymantecML.Attribute.HighConfidence
ESET-NOD32a variant of Win32/Kryptik.GKZJ
APEXMalicious
AvastWin32:Malware-gen
KasperskyHEUR:Packed.Win32.Katusha.gen
BitDefenderGen:Variant.Graftor.519151
NANO-AntivirusTrojan.Win32.GenKryptik.fiapdo
MicroWorld-eScanGen:Variant.Graftor.519151
TencentWin32.Trojan.Generic.Ebqn
Ad-AwareGen:Variant.Graftor.519151
SophosGeneric ML PUA (PUA)
ComodoApplication.Win32.ICLoader.GS@84429a
BitDefenderThetaGen:NN.ZexaF.34294.IoLfaWDhWlhi
VIPRETrojan.Win32.Generic!BT
McAfee-GW-EditionBehavesLike.Win32.Generic.vc
FireEyeGeneric.mg.8c41c44d39fac7fa
EmsisoftGen:Variant.Graftor.519151 (B)
SentinelOneStatic AI – Malicious PE
JiangminAdWare.ICLoader.kvs
AviraTR/ICLoader.Gen8
eGambitUnsafe.AI_Score_99%
Antiy-AVLTrojan/Generic.ASMalwS.2818ABE
MicrosoftTrojan:Win32/Occamy.C
GDataGen:Variant.Graftor.519151
McAfeeGenericRXAA-AA!8C41C44D39FA
MAXmalware (ai score=99)
VBA32BScope.Trojan.Downloader
MalwarebytesAdware.ICLoader.Generic
PandaTrj/CI.A
RisingTrojan.Kryptik!1.AA23 (CLASSIC)
YandexTrojan.GenAsa!lpWCzBCFZvw
IkarusPUA.ICLoader
MaxSecureTrojan.Malware.300983.susgen
FortinetW32/CoinMiner.GYQC!tr
AVGWin32:Malware-gen
Paloaltogeneric.ml

How to remove Graftor.519151?

Graftor.519151 removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment