AIT.Heur2.Downloader.1.ED54D271.Gen removal guide

The AIT.Heur2.Downloader.1.ED54D271.Gen is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What AIT.Heur2.Downloader.1.ED54D271.Gen virus can do?

SetUnhandledExceptionFilter detected (possible anti-debug)
Yara rule detections observed from a process memory dump/dropped files/CAPE
Creates RWX memory
Dynamic (imported) function loading detected
Performs HTTP requests potentially not found in PCAP.
Authenticode signature is invalid
Attempts to modify proxy settings
Harvests cookies for information gathering

Related domains:

wpad.local-net

www.upload.ee

How to determine AIT.Heur2.Downloader.1.ED54D271.Gen?


File Info:
name: 35EF6C63A7731777E2FD.mlw
path: /opt/CAPEv2/storage/binaries/d9551a84ff21b267998106140b2a89bc189d2a07ef174b3d165cba73b90e9201
crc32: 62B09109
md5: 35ef6c63a7731777e2fdbe348816d66d
sha1: 8a11e8c30ee57e3296e47b1c83f8a1cc9bf1d862
sha256: d9551a84ff21b267998106140b2a89bc189d2a07ef174b3d165cba73b90e9201
sha512: 6aa7581427a8fc525c9d336a1de379896cff0e81e40170fca4d198cafdda332ab2ddf80ef9a05b62de46573a7613b2f356601c45042e18ea0529cd8b5445e8a9
ssdeep: 12288:mCdOy3vVrKxR5CXbNjAOxK/j2n+4YG/6c1mFFja3mXgcjfRlgsUBgauTMAQ:mCdxte/80jYLT3U1jfsWaWMAQ
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1B7059D2273DDC370CB669173BF69B7016EBF78614630B85B2F880D7DA950161262DBA3
sha3_384: 1a8fdc05b023781cd145763bcc30e038be2513be0e1e913e2fca5f3f6acb88d8a9e450c3c16f0e01d703ba0873c01e90
ep_bytes: e8b8d00000e97ffeffffcccccccccccc
timestamp: 2021-11-23 19:06:43

Version Info:
Translation: 0x0809 0x04b0

AIT.Heur2.Downloader.1.ED54D271.Gen also known as:

FireEye	AIT.Heur2.Downloader.1.ED54D271.Gen
ALYac	AIT.Heur2.Downloader.1.ED54D271.Gen
Cybereason	malicious.3a7731
ESET-NOD32	Win32/TrojanDownloader.Autoit.OIE
APEX	Malicious
Cynet	Malicious (score: 99)
Kaspersky	HEUR:Trojan-Downloader.Win32.Generic
BitDefender	AIT.Heur2.Downloader.1.ED54D271.Gen
MicroWorld-eScan	AIT.Heur2.Downloader.1.ED54D271.Gen
Ad-Aware	AIT.Heur2.Downloader.1.ED54D271.Gen
McAfee-GW-Edition	BehavesLike.Win32.Injector.ch
Emsisoft	AIT.Heur2.Downloader.1.ED54D271.Gen (B)
GData	AIT.Heur2.Downloader.1.ED54D271.Gen (2x)
Avira	HEUR/AGEN.1144389
Arcabit	AIT.Heur2.Downloader.1.ED54D271.Gen
Microsoft	Trojan:Win32/Sabsik.TE.B!ml
MAX	malware (ai score=82)
Fortinet	W32/Autoit.OGF!tr.dldr
MaxSecure	Trojan.Malware.300983.susgen

How to remove AIT.Heur2.Downloader.1.ED54D271.Gen?

AIT.Heur2.Downloader.1.ED54D271.Gen removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

AIT.Heur2.Downloader.1.ED54D271.Gen removal guide