Malware

About “Graftor.534635” infection

Malware Removal

The Graftor.534635 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Graftor.534635 virus can do?

  • Executable code extraction
  • Attempts to connect to a dead IP:Port (1 unique times)
  • Creates RWX memory
  • A process attempted to delay the analysis task.
  • Repeatedly searches for a not-found process, may want to run with startbrowser=1 option
  • HTTP traffic contains suspicious features which may be indicative of malware related traffic
  • Performs some HTTP requests
  • Unconventionial binary language: Chinese (Simplified)
  • Unconventionial language used in binary resources: Chinese (Simplified)
  • Attempts to modify proxy settings
  • Creates a copy of itself

How to determine Graftor.534635?


File Info:

crc32: A2C889F5
md5: 32bdf26382bed1a18f39f9003bd1f9d1
name: 32BDF26382BED1A18F39F9003BD1F9D1.mlw
sha1: 0ba70c94bdfecad136296f4afbe8a2e34dccfe64
sha256: 2addf0687e15d5da150548c7dd1d27bd3138b8ed464e0fe8cc6d091e34842ed3
sha512: 7806592662c25094c13856ba54937ae8e08ae137e64388cde61fee260e5aeb632e5fc2061766817d39878b622538cc10f2303791bb579fbfedf5b8740313f13b
ssdeep: 6144:I4Yym8DPY4MIgHGT6jdFAjngP2Ybk/PvJ6+i:Qh8M4MbHGGjdFAjnOUp6
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

LegalCopyright: x7248x6743x6240x6709 (C) 2007
InternalName: UGMS
FileVersion: 1, 0, 0, 1
CompanyName:
LegalTrademarks:
ProductName: UGMS x5e94x7528x7a0bx5e8f
ProductVersion: 1, 0, 0, 1
FileDescription: UGMS Microsoft x57fax7840x7c7bx5e94x7528x7a0bx5e8f
OriginalFilename: UGMS.EXE
Translation: 0x0804 0x04b0

Graftor.534635 also known as:

BkavW32.AIDetectVM.malware1
Elasticmalicious (high confidence)
MicroWorld-eScanGen:Variant.Graftor.534635
FireEyeGeneric.mg.32bdf26382bed1a1
CAT-QuickHealTrojan.Multi
McAfeeRDN/Generic.dx
CylanceUnsafe
VIPRETrojan.Win32.Generic!BT
K7AntiVirusTrojan ( 00571cd51 )
BitDefenderGen:Variant.Graftor.534635
K7GWTrojan ( 00571cd51 )
Cybereasonmalicious.382bed
TrendMicroBackdoor.Win32.ZEGOST.THKBBBO
CyrenW32/Kryptik.BWY.gen!Eldorado
SymantecTrojan.Gen.2
APEXMalicious
AvastWin32:Trojan-gen
ClamAVWin.Malware.Gh0stRAT-7459730-1
KasperskyHEUR:Backdoor.Win32.Lotok.gen
AlibabaBackdoor:Win32/Zegost.5c45a37d
AegisLabTrojan.Multi.Generic.4!c
RisingTrojan.Kryptik!1.CC61 (CLASSIC)
Ad-AwareGen:Variant.Graftor.534635
F-SecureTrojan.TR/Crypt.Agent.yfunn
InvinceaMal/Generic-S
McAfee-GW-EditionRDN/Generic.dx
EmsisoftTrojan.Crypt (A)
AviraTR/Crypt.Agent.yfunn
KingsoftWin32.Troj.Generic_a.a.(kcloud)
MicrosoftBackdoor:Win32/Zegost.CQ!bit
GridinsoftTrojan.Win32.Agent.oa
ArcabitTrojan.Graftor.D8286B
ZoneAlarmHEUR:Backdoor.Win32.Lotok.gen
GDataGen:Variant.Graftor.534635
CynetMalicious (score: 100)
AhnLab-V3Malware/Win32.Generic.C4228977
BitDefenderThetaGen:NN.ZexaF.34634.vq0@a8B9Ihgb
ALYacGen:Variant.Graftor.534635
MAXmalware (ai score=80)
VBA32BScope.Backdoor.Lotok
PandaTrj/GdSda.A
ESET-NOD32a variant of Win32/Kryptik.HGZI
TrendMicro-HouseCallBackdoor.Win32.ZEGOST.THKBBBO
TencentWin32.Backdoor.Lotok.Ljuj
IkarusTrojan.Win32.Farfli
FortinetW32/Kryptik.HFPG!tr
AVGWin32:Trojan-gen
Paloaltogeneric.ml
Qihoo-360Win32/Backdoor.3cb

How to remove Graftor.534635?

Graftor.534635 removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment