Trojan Graftor – bat.bat – 3048ec26573e8157fff2ebbb22d9d39c

Trojan Graftor
Also known as: Trojan ADH, Trojan Jbox
SHA256: b911a2776265c96615b58f37725d7cc053c19d78e68e2ab3cdd8bb576b042ba3
SHA1: c51af500881fe93343e300c5350acce9e70b0667
MD5: 3048ec26573e8157fff2ebbb22d9d39c
File size: 1518212 bytes

Created files:

%AppData%\Adobe32\bat.bat – Trojan Graftor
%AppData%\Adobe32\libcurl.dll – Trojan Graftor
%AppData%\Adobe32\libeay32.dll – Trojan Graftor
%AppData%\Adobe32\libidn-11.dll – Trojan Graftor
%AppData%\Adobe32\libpdcurses.dll – Trojan Graftor
%AppData%\Adobe32\libssl32.dll – Trojan Graftor
%AppData%\Adobe32\pthreadGC2.dll – Trojan Graftor
%AppData%\Adobe32\svchost.exe – Trojan Graftor

Trojan Graftor created autostart registry keys:

HKCU\Software\Microsoft\Windows\CurrentVersion\run\AdobeUpdate: wscript “%AppData%\Adobe32\invis.vbs” “%AppData%\Adobe32\bat.bat”