Should I remove "Graftor.858108 (B)"?

The Graftor.858108 (B) is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Graftor.858108 (B) virus can do?

Executable code extraction
Attempts to connect to a dead IP:Port (2 unique times)
Creates RWX memory
A process attempted to delay the analysis task.
At least one IP Address, Domain, or File Name was found in a crypto call
Reads data out of its own binary image
HTTP traffic contains suspicious features which may be indicative of malware related traffic
Performs some HTTP requests
Unconventionial binary language: Chinese (Simplified)
Unconventionial language used in binary resources: Chinese (Simplified)
The binary likely contains encrypted or compressed data.
The executable is compressed using UPX
Queries information on disks, possibly for anti-virtualization
Tries to unhook or modify Windows functions monitored by Cuckoo
Network activity contains more than one unique useragent.
Attempts to create or modify system certificates

Related domains:

www.baidu.com

q1.qlogo.cn

api.freeyun.net

bgp.freeyun.net

How to determine Graftor.858108 (B)?


File Info:
crc32: 63B0D015
md5: 6bd557a8ed5a7da56762e1bd99485685
name: 6BD557A8ED5A7DA56762E1BD99485685.mlw
sha1: 9a47c09c481aa97f1c60decf52f4c6ade91577e4
sha256: 7ecf41af381c05eb3328f5fc75b6dfd8cc92a72fd97e46e9fd0afcf65e137c1b
sha512: a61a5d9488764281a7463086a9b712c8dfbac45fca87ffac18024e8fbf29ab24a5da578cb1c35d8066d81e5d5a8a61087e82abf9f9ec959c28859447f4082638
ssdeep: 24576:ebd2r5q7yFgdrybYoaHBuf8d+nKN00JdIwo:eOTFg1ybYo/IoCi
type: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed

Version Info:
LegalCopyright: x90d1x5ddex8354x5c0fx652fx8f6fx4ef6x79d1x6280x6709x9650x516cx53f8
FileVersion: 1.0.0.0
CompanyName: B2itool
Comments: QQx9753x53f7x52a9x624b
ProductName: QQx9753x53f7x52a9x624b
ProductVersion: 1.0.0.0
FileDescription: QQx9753x53f7x52a9x624b
Translation: 0x0804 0x04b0

Graftor.858108 (B) also known as:

Bkav	W32.AIDetect.malware1
K7AntiVirus	Trojan ( 005246d51 )
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
ALYac	Gen:Variant.Graftor.858108
Cylance	Unsafe
CrowdStrike	win/malicious_confidence_90% (W)
BitDefender	Gen:Variant.Graftor.858108
K7GW	Trojan ( 005246d51 )
Cybereason	malicious.8ed5a7
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Packed.FlyStudio.AA potentially unwanted
APEX	Malicious
MicroWorld-eScan	Gen:Variant.Graftor.858108
Ad-Aware	Gen:Variant.Graftor.858108
Sophos	Generic PUA JK (PUA)
Comodo	Packed.Win32.MUPX.Gen@24tbus
BitDefenderTheta	Gen:NN.ZexaF.34670.2mKfauAlgkmb
McAfee-GW-Edition	BehavesLike.Win32.Generic.cc
FireEye	Generic.mg.6bd557a8ed5a7da5
Emsisoft	Gen:Variant.Graftor.858108 (B)
SentinelOne	Static AI – Malicious PE
eGambit	HackTool.Generic
Microsoft	Program:Win32/Wacapew.C!ml
Arcabit	Trojan.Graftor.DD17FC
GData	Gen:Variant.Graftor.858108
AhnLab-V3	Malware/Win32.Generic.C2889249
Acronis	suspicious
McAfee	Artemis!6BD557A8ED5A
MAX	malware (ai score=84)
VBA32	BScope.Trojan.Downloader
Malwarebytes	Malware.Heuristic.1003
TrendMicro-HouseCall	TROJ_GEN.R014H09D121
Rising	Malware.Heuristic!ET#92% (RDMK:cmRtazp8FZ4R5r0ZTD/MMsDoYi8Y)
Fortinet	W32/Agent.65CA!tr
Paloalto	generic.ml

How to remove Graftor.858108 (B)?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Should I remove “Graftor.858108 (B)”?