How to remove Graphiron Stealer from the operating system

What kind of malware is Graphiron?

Graphiron is an information stealer written in Go programming language. It is capable of extracting various information from the infected operating systems. It is known that cybercriminals behind Graphiron stealer target users in Ukraine.

More about Graphiron

Graphiron is a dual-phase malware made up of a downloader and a payload. The downloader includes predefined addresses for its C&C servers. Upon execution, it checks for the presence of any anti-malware tools by scanning for running processes.

If no prohibited processes are detected, the downloader connects to its C&C server, downloads and decrypts the payload. The downloader is designed to only run once and will not make additional attempts if it fails to install the payload.

Once active, Graphiron can read MachineGuid (a unique identifier for a machine), obtain the IP address, hostname, user info, system info, steal data from Firefox and Thunderbird, extract private keys from MobaXTerm, steal stored passwords, and arbitrary files.

Also, Graphiron can capture screenshots, list and create directories, run shell commands, and steal data from PuTTY. Cybercriminals may misuse the obtained information for various malicious purposes. For instance, to steal online accounts and identities and make fraudulent purchases and transactions.

Threat Summary:

Name	Graphiron information stealer
Threat Type	Info stealer
Detection Names	Avast (Win64:Trojan-gen), Combo Cleaner (Trojan.Generic.31811635), ESET-NOD32 (A Variant Of WinGo/PSW.Agent.BU), Kaspersky (Trojan-PSW.Win64.BroPass.bcl), Microsoft (Trojan:Win32/Wacatac.B!ml), Full List (VirusTotal)
Symptoms	It is common for information-stealing malware to be designed to stealthily infiltrate the victim's computer and remain silent, and thus no particular symptoms are clearly visible on an infected machine.
Distribution methods	Infected email attachments, malicious online advertisements, social engineering, software 'cracks'.
Damage	Stolen passwords, identity theft, monetary loss, and other issues.
Malware Removal (Windows)	To eliminate possible malware infections, scan your computer with legitimate antivirus software. Our security researchers recommend using Combo Cleaner. ▼ Download Combo Cleaner To use full-featured product, you have to purchase a license for Combo Cleaner. 7 days free trial available. Combo Cleaner is owned and operated by Rcs Lt, the parent company of PCRisk.com read more.

Stealers in general

Information stealers are designed to extract sensitive information, such as passwords, credit card numbers, banking details, personal photos, documents, etc. The capabilities of these stealers vary (e.g., they can log keystrokes, steal clipboard data, extract data from specified apps, etc.). Typically, they are used for monetary gain. Examples of different stealers are Creal Stealer, Album Stealer, and RL Stealer.

How did Graphiron infiltrate my computer?

Cybercriminals often use deceptive emails with malicious attachments or links or websites hosting pirated software (or cracking tools, key generators) to trick users into downloading and executing ransomware. Downloading files from unreliable sources, such as P2P networks, free file hosting sites, third-party downloaders, etc., can also lead to computer infections.

Threat actors also use fake software updaters and Trojans to distribute ransomware. In most cases, users infect computers through malicious MS Office or PDF documents, executables, JavaScript files, archives, ISO files, or other file types.

How to avoid installation of malware?

Download software from reliable sources such as official websites and stores. Avoid downloads from Peer-to-Peer networks, untrusted websites, third-party downloaders, and similar sources. Do not trust ads on questionable websites.

Be wary of unexpected or irrelevant emails from unknown or suspicious addresses. Do not click on links or download attachments from such emails - they could be malicious. Regularly update your operating system and installed programs to ensure that you have the latest security fixes and features.

If you believe that your computer is already infected, we recommend running a scan with Combo Cleaner Antivirus for Windows to automatically eliminate infiltrated malware.

Instant automatic malware removal: Manual threat removal might be a lengthy and complicated process that requires advanced IT skills. Combo Cleaner is a professional automatic malware removal tool that is recommended to get rid of malware. Download it by clicking the button below:
▼ DOWNLOAD Combo Cleaner By downloading any software listed on this website you agree to our Privacy Policy and Terms of Use. To use full-featured product, you have to purchase a license for Combo Cleaner. 7 days free trial available. Combo Cleaner is owned and operated by Rcs Lt, the parent company of PCRisk.com read more.

Quick menu:

• What is Graphiron?
• STEP 1. Manual removal of Graphiron malware.
• STEP 2. Check if your computer is clean.

How to remove malware manually?

Manual malware removal is a complicated task - usually it is best to allow antivirus or anti-malware programs to do this automatically. To remove this malware we recommend using Combo Cleaner Antivirus for Windows.

If you wish to remove malware manually, the first step is to identify the name of the malware that you are trying to remove. Here is an example of a suspicious program running on a user's computer:

If you checked the list of programs running on your computer, for example, using task manager, and identified a program that looks suspicious, you should continue with these steps:

Download a program called Autoruns. This program shows auto-start applications, Registry, and file system locations:

Restart your computer into Safe Mode:

Windows XP and Windows 7 users: Start your computer in Safe Mode. Click Start, click Shut Down, click Restart, click OK. During your computer start process, press the F8 key on your keyboard multiple times until you see the Windows Advanced Option menu, and then select Safe Mode with Networking from the list.

Video showing how to start Windows 7 in "Safe Mode with Networking":

Windows 8 users: Start Windows 8 is Safe Mode with Networking - Go to Windows 8 Start Screen, type Advanced, in the search results select Settings. Click Advanced startup options, in the opened "General PC Settings" window, select Advanced startup.

Click the "Restart now" button. Your computer will now restart into the "Advanced Startup options menu". Click the "Troubleshoot" button, and then click the "Advanced options" button. In the advanced option screen, click "Startup settings".

Click the "Restart" button. Your PC will restart into the Startup Settings screen. Press F5 to boot in Safe Mode with Networking.

Video showing how to start Windows 8 in "Safe Mode with Networking":

Windows 10 users: Click the Windows logo and select the Power icon. In the opened menu click "Restart" while holding "Shift" button on your keyboard. In the "choose an option" window click on the "Troubleshoot", next select "Advanced options".

In the advanced options menu select "Startup Settings" and click on the "Restart" button. In the following window you should click the "F5" button on your keyboard. This will restart your operating system in safe mode with networking.

Video showing how to start Windows 10 in "Safe Mode with Networking":

Extract the downloaded archive and run the Autoruns.exe file.

In the Autoruns application, click "Options" at the top and uncheck "Hide Empty Locations" and "Hide Windows Entries" options. After this procedure, click the "Refresh" icon.

Check the list provided by the Autoruns application and locate the malware file that you want to eliminate.

You should write down its full path and name. Note that some malware hides process names under legitimate Windows process names. At this stage, it is very important to avoid removing system files. After you locate the suspicious program you wish to remove, right click your mouse over its name and choose "Delete".

After removing the malware through the Autoruns application (this ensures that the malware will not run automatically on the next system startup), you should search for the malware name on your computer. Be sure to enable hidden files and folders before proceeding. If you find the filename of the malware, be sure to remove it.

Reboot your computer in normal mode. Following these steps should remove any malware from your computer. Note that manual threat removal requires advanced computer skills. If you do not have these skills, leave malware removal to antivirus and anti-malware programs.

These steps might not work with advanced malware infections. As always it is best to prevent infection than try to remove malware later. To keep your computer safe, install the latest operating system updates and use antivirus software. To be sure your computer is free of malware infections, we recommend scanning it with Combo Cleaner Antivirus for Windows.

Frequently Asked Questions (FAQ)

My computer is infected with Graphiron malware, should I format my storage device to get rid of it?

Formatting is not necessary to remove malware like Graphiron. In most cases, malware can be removed by using anti-virus software.

What are the biggest issues that malware can cause?

Malware can have serious consequences such as theft of personal information, file encryption, financial losses, disruption of computer systems, spreading to other computers on a network, installation of additional malware or unwanted programs, using the computer's resources for cryptocurrency mining, and more.

What is the purpose of Graphiron malware?

Graphiron can perform various malicious actions such as reading the MachineGuid, acquiring the IP address, hostname, user information, and system information, stealing data from Firefox and Thunderbird, extracting private keys from MobaXTerm, stealing stored passwords, and any arbitrary files. Additionally, it can capture screenshots, list and create directories, run shell commands, and steal data from PuTTY.

How did a malware infiltrate my computer?

Malware can be distributed using malicious email attachments or links, drive-by downloads, vulnerabilities in software, fake installers, installers for pirated software (and cracking tools, key generators), P2P networks, third-party downloaders, etc. Users infect computers when they download and execute malware.

Will Combo Cleaner protect me from malware?

Combo Cleaner is a security tool that is capable of detecting and removing a wide range of malware infections, including high-end malware that may hide deep within the system. It is important to note that in order to eliminate all malware, a full system scan is recommended.

▼ Show Discussion