Categories: Malware

What is “Malware.AI.126425380”?

The Malware.AI.126425380 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Malware.AI.126425380 virus can do?

SetUnhandledExceptionFilter detected (possible anti-debug)
Behavioural detection: Executable code extraction – unpacking
At least one process apparently crashed during execution
Yara rule detections observed from a process memory dump/dropped files/CAPE
Creates RWX memory
Dynamic (imported) function loading detected
CAPE extracted potentially suspicious content
Unconventionial language used in binary resources: Russian
Authenticode signature is invalid
Anomalous binary characteristics

How to determine Malware.AI.126425380?


File Info:
name: E7C98BE516493FE6F050.mlwpath: /opt/CAPEv2/storage/binaries/43c4ee736f0ab8ef16b4774f855162f4dcdfa5a66901339efb62693a0566ab04crc32: 273B5DC2md5: e7c98be516493fe6f050c06ab87def15sha1: 9a8625eca0128da1f076bd6ad7749e32377e26f2sha256: 43c4ee736f0ab8ef16b4774f855162f4dcdfa5a66901339efb62693a0566ab04sha512: 4553ac2949040c457d952db404b13a4d29c21ce010cb3368f86e77b6f9391906cc41f710299a66ff17bcf50e7162fb1643f4ddfa6c07e507f22f8c742470f5f8ssdeep: 6144:ulkbDvnlH/VDwiUFBMXxPNbPxjmsfgL3vzkaj/Z0VyI1Tab5uDOOCXW8plYAfLH:u0nlfelWNbPxjmFL3vznReyFbsDO3XNTtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T16784019B847596C0D2701B36980F0F24F8B9689F133750067EE9FC4E6B5BB6AE06B113sha3_384: 730cdb8fb249c9a947497f9c743425157513f7f529712896421f372f0a2a3d07e676be05cad69c61c4dcc88b5d0ad69aep_bytes: 817de04535000075186a336831577843timestamp: 2007-02-07 13:34:02
Version Info:
CompanyName: нПмаХчаавлвЙУцЧвДЧЯьщаFileDescription: ЫАцВЛГЖБишПОСоЦаЖнВмчвуцFileVersion: 122.34.64.19InternalName: СйЙЬеноХоШАФлмЬпфФИЮАакйЬеЛурOriginalFilename: GPfu.exeProductName: кеаЗТЮшйЯаъБрТЮЫЩНШРмЕжЫНЮжProductVersion: 122.34.64.19Translation: 0x04b0 0x0417

Malware.AI.126425380 also known as:

Lionic	Hacktool.Win32.Krap.x!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Ser.Razy.11068
FireEye	Generic.mg.e7c98be516493fe6
ALYac	Gen:Variant.Ser.Razy.11068
Cylance	Unsafe
Zillya	Trojan.Kryptik.Win32.880567
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Trojan ( 0055dd191 )
Alibaba	TrojanPSW:Win32/Obfuscator.6a332e8b
K7GW	Trojan ( 0055dd191 )
Cybereason	malicious.516493
VirIT	Trojan.Win32.Packed.BECL
Cyren	W32/Qakbot.A.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Kryptik.EJT
APEX	Malicious
Paloalto	generic.ml
Kaspersky	Packed.Win32.Krap.gx
BitDefender	Gen:Variant.Ser.Razy.11068
NANO-Antivirus	Trojan.Win32.Krap.cvqlid
Avast	FileRepMalware
Tencent	Win32.Packed.Krap.Ammb
Ad-Aware	Gen:Variant.Ser.Razy.11068
Sophos	Mal/Generic-R + Mal/Qbot-B
Comodo	MalCrypt.Indus!@1qrzi1
DrWeb	Trojan.Packed.20343
VIPRE	Trojan.Win32.Nedsym.f (v)
TrendMicro	BKDR_QAKBOT.SMB
McAfee-GW-Edition	PWS-Zbot.gen.aum
Emsisoft	Gen:Variant.Ser.Razy.11068 (B)
SentinelOne	Static AI – Malicious PE
GData	Gen:Variant.Ser.Razy.11068
Jiangmin	Packed.Katusha.idy
Avira	TR/Dropper.Gen
Antiy-AVL	Trojan/Generic.ASMalwS.FD679
Gridinsoft	Ransom.Win32.Zbot.sa
ZoneAlarm	Packed.Win32.Krap.gx
Microsoft	PWS:Win32/Zbot.gen!Q
Cynet	Malicious (score: 100)
Acronis	suspicious
McAfee	PWS-Zbot.gen.aum
MAX	malware (ai score=100)
VBA32	Trojan.Packed
Malwarebytes	Malware.AI.126425380
TrendMicro-HouseCall	BKDR_QAKBOT.SMB
Rising	Dropper.Obitel!8.1F55 (CLOUD)
Ikarus	Packer.Win32.Krap
Fortinet	W32/Generic.AC.2AA013!tr
BitDefenderTheta	AI:Packer.7DBFF0131F
AVG	FileRepMalware
Panda	Trj/Krapack.gen
CrowdStrike	win/malicious_confidence_100% (D)