Graftor malware family
Graftor is a malware family tracked by MalwareAnalyzer by Cyble across 3 publicly analyzed samples. First seen 2026-07-30, most recently 2026-08-23. Observed ATT&CK techniques include T1056.001, T1112, T1547.001.
Corpus statistics
- Publicly analyzed samples: 3
- First seen: 2026-07-30
- Last seen: 2026-08-23
- Verdicts: malicious 3
- File types: pe 3
ATT&CK techniques used by Graftor
Extracted command-and-control infrastructure
- http://shunwang.miaoxia8.com/static/MultiAD.js - 1 sample
- http://t.icafe66.com/static/allinone.js - 1 sample
Recent Graftor samples
- bab4d7840a0b64278aa9608006bf9693fd2ce36961bcf37870ee4090bcf08d7d - malicious (2026-08-23)
- ead3927f1a30860d8c872741d1c7fdc0ead1ee3f55003a64a567142443747a4f - malicious (2026-08-16)
- 8a0c95be8a40ae5419f7d97bb3e91b2b - malicious (2026-07-30)
Frequently asked about Graftor
- What is Graftor?
- Graftor is a malware family tracked by MalwareAnalyzer by Cyble across 3 publicly analyzed samples. First seen 2026-07-30, most recently 2026-08-23. Observed ATT&CK techniques include T1056.001, T1112, T1547.001.
- How many Graftor samples have been analyzed?
- MalwareAnalyzer by Cyble holds 3 publicly analyzed samples attributed to Graftor, first seen 2026-07-30 and most recently 2026-08-23. This counts public submissions to this platform only, so it is a measure of what we have seen rather than of the family's total prevalence.
- What MITRE ATT&CK techniques does Graftor use?
- Across our Graftor samples the most frequently observed techniques are T1056.001 (2), T1112 (2), T1547.001 (1). Counts are the number of analyzed samples in which each technique was observed.
- What file types does Graftor use?
- Graftor samples in this corpus are distributed as pe (3).
- Does Graftor use command-and-control infrastructure?
- Yes. 2 distinct command-and-control indicators have been extracted from Graftor samples, either from static configuration or from traffic captured during sandbox detonation. The full list is published on the family page.
- Is Graftor malicious?
- 3 of 3 analyzed Graftor samples were scored malicious by the fused verdict, which combines multi-engine static scanning, YARA and hash reputation with behavior captured during real sandbox detonation. Each report lists every signal that contributed to its score.
Latest analyzed threats · ATT&CK coverage across the corpus · Threat trends