Malware

About “Malware.AI.1105040624” infection

Malware Removal

The Malware.AI.1105040624 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Malware.AI.1105040624 virus can do?

  • Behavioural detection: Executable code extraction – unpacking
  • Sample contains Overlay data
  • Yara rule detections observed from a process memory dump/dropped files/CAPE
  • CAPE extracted potentially suspicious content
  • The binary contains an unknown PE section name indicative of packing
  • The binary likely contains encrypted or compressed data.
  • The executable is compressed using UPX
  • Authenticode signature is invalid
  • Creates a copy of itself
  • Deletes executed files from disk

How to determine Malware.AI.1105040624?


File Info:

name: FAF5CE89989D833A315A.mlw
path: /opt/CAPEv2/storage/binaries/aa5a92dc75457313561dd3cddc590b59585c1275222d2e591a6d88b5d9221b13
crc32: FFDBED2B
md5: faf5ce89989d833a315ad860de9ab465
sha1: 53dd4601477fb6f9ad6da235e853d80f9de842a3
sha256: aa5a92dc75457313561dd3cddc590b59585c1275222d2e591a6d88b5d9221b13
sha512: eaf2249d2486f3d5277d00ddd0f8a1342cda3aae269d868e61244913157f546a027dbd8486119bcc4e6f7a098a67d76f37e831238b71a0393e70c823a36fe78e
ssdeep: 1536:gYSxH+zBd1SEs5N+6/xaZHZ7qSU/CYHEHa4vf0CmuJd4BXL:gYyHO1F64LGrxHuLfBbd45
type: PE32 executable (console) Intel 80386, for MS Windows
tlsh: T104830291B3C35F3DD915B3F817F43EB23517919026E86003A65A0D3A90995FED4EAF0A
sha3_384: 214ae6dff4aa4ff751161b6fb836112adfd1d425a620492147bdd2eb1d12d0a273e2ea072b59f7dfe5d2a787bcd480af
ep_bytes: bb000000005629ff8b142483c404575f
timestamp: 1970-01-01 00:00:00

Version Info:

0: [No Data]

Malware.AI.1105040624 also known as:

BkavW32.AIDetect.malware2
LionicTrojan.Win32.Copak.4!c
tehtrisGeneric.Malware
MicroWorld-eScanGen:Variant.Babar.67952
ClamAVWin.Packed.Copak-9853643-0
FireEyeGeneric.mg.faf5ce89989d833a
ALYacGen:Variant.Babar.67952
CylanceUnsafe
ZillyaTrojan.Kryptik.Win32.3262073
SangforSuspicious.Win32.Save.a
K7AntiVirusTrojan ( 0058c5ff1 )
AlibabaTrojan:Win32/Copak.875437f3
K7GWTrojan ( 0058c5ff1 )
Cybereasonmalicious.1477fb
CyrenW32/Kryptik.DCC.gen!Eldorado
SymantecML.Attribute.HighConfidence
Elasticmalicious (high confidence)
ESET-NOD32a variant of Win32/Kryptik.HITO
APEXMalicious
Paloaltogeneric.ml
CynetMalicious (score: 100)
KasperskyHEUR:Trojan.Win32.Copak.vho
BitDefenderGen:Variant.Babar.67952
NANO-AntivirusTrojan.Win32.Agent.ixszcw
AvastWin32:Evo-gen [Trj]
TencentTrojan.Win32.Copak.hb
Ad-AwareGen:Variant.Babar.67952
EmsisoftGen:Variant.Babar.67952 (B)
ComodoPacked.Win32.MUPX.Gen@24tbus
DrWebTrojan.Packed2.43250
VIPREGen:Variant.Babar.67952
McAfee-GW-EditionBehavesLike.Win32.BadFile.mc
SophosML/PE-A + Troj/Agent-BGZJ
SentinelOneStatic AI – Malicious PE
GDataGen:Variant.Babar.67952
JiangminTrojan.Copak.ceh
AviraHEUR/AGEN.1200606
Antiy-AVLTrojan/Generic.ASBOL.C686
ArcabitTrojan.Babar.D10970
MicrosoftTrojan:Win32/Ditertag.A
GoogleDetected
Acronissuspicious
McAfeeGenericRXAA-FA!FAF5CE89989D
MAXmalware (ai score=100)
VBA32BScope.Trojan.Wacatac
MalwarebytesMalware.AI.1105040624
RisingTrojan.Kryptik!1.D12D (CLASSIC)
IkarusTrojan.Kryptik
MaxSecureTrojan.Malware.300983.susgen
FortinetW32/Kryptik.HITO!tr
BitDefenderThetaGen:NN.ZexaF.34698.fmY@aqxLbnk
AVGWin32:Evo-gen [Trj]
PandaTrj/Genetic.gen
CrowdStrikewin/malicious_confidence_100% (W)

How to remove Malware.AI.1105040624?

Malware.AI.1105040624 removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment