Malware

Malware.AI.135859893 removal tips

Malware Removal

The Malware.AI.135859893 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Malware.AI.135859893 virus can do?

  • Attempts to connect to a dead IP:Port (1 unique times)
  • Detected script timer window indicative of sleep style evasion
  • Reads data out of its own binary image
  • Attempts to modify Internet Explorer’s start page
  • Drops a binary and executes it
  • Performs some HTTP requests
  • Unconventionial binary language: Chinese (Simplified)
  • Unconventionial language used in binary resources: Chinese (Simplified)
  • The binary likely contains encrypted or compressed data.
  • The executable is compressed using UPX
  • A scripting utility was executed
  • Uses Windows utilities for basic functionality
  • Deletes its original binary from disk
  • Network activity contains more than one unique useragent.
  • Installs itself for autorun at Windows startup
  • Creates a hidden or system file
  • Attempts to modify proxy settings
  • Creates a slightly modified copy of itself

Related domains:

web.kago.club
hkd-1306816441.cos.ap-guangzhou.myqcloud.com

How to determine Malware.AI.135859893?


File Info:

crc32: 498DAC66
md5: bdb792a57ce88cafcddedb2520548bcc
name: BDB792A57CE88CAFCDDEDB2520548BCC.mlw
sha1: 4aa773f74b52023523a889e9f70b082a6cb6543f
sha256: efa1790c8701327f484a9dc2bc270edcc7df18eb8b87c1f7dded97ed75684135
sha512: 8d7e2886ff72db550d99d14973c799b7af19262f03b66a50b33851d9f07fb9d731a2e0f249180782ecd1475d34d77f056fe284ff07317912099bfbd17d5c4d27
ssdeep: 49152:fplqkm/XiPnxx5EMAW/DMda5ZhpQiQR/Z9UYHHQQzVicgks47rM7SjsrvWzdLbG:fWiPnxx5EMH/DMda3hSiM/Z9UYQQzVi
type: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed

Version Info:

LegalCopyright: skyx7684x7248x6743x6240x6709
FileVersion: 10.18.1.0
CompanyName: sky
Comments: MySkin LOL
ProductName: MySkin
ProductVersion: 10.18.1.0
FileDescription: MySkin LOL
Translation: 0x0804 0x04b0

Malware.AI.135859893 also known as:

BkavW32.AIDetect.malware2
K7AntiVirusAdware ( 005071f51 )
Elasticmalicious (high confidence)
DrWebTrojan.StartPage1.60617
CynetMalicious (score: 100)
ALYacGen:Trojan.StartPage.1oLfaatVofmb
CylanceUnsafe
ZillyaTrojan.Agent.Win32.2544527
SangforTrojan.Win32.Save.a
K7GWAdware ( 005071f51 )
Cybereasonmalicious.57ce88
CyrenW32/Trojan.CLL.gen!Eldorado
SymantecML.Attribute.HighConfidence
ESET-NOD32a variant of Win32/Packed.FlyStudio.AA potentially unwanted
APEXMalicious
AvastWin32:Adware-gen [Adw]
ClamAVWin.Malware.Bulz-9889678-0
Kasperskynot-a-virus:AdWare.Win32.Agent.gen
BitDefenderGen:Trojan.StartPage.1oLfaatVofmb
MicroWorld-eScanGen:Trojan.StartPage.1oLfaatVofmb
TencentMalware.Win32.Gencirc.10cf7e29
Ad-AwareGen:Trojan.StartPage.1oLfaatVofmb
SophosMal/Agent-AVP
ComodoPacked.Win32.MUPX.Gen@24tbus
BitDefenderThetaGen:NN.ZexaF.34266.1oLfaatVofmb
TrendMicroTROJ_GEN.R03BC0DKC21
McAfee-GW-EditionBehavesLike.Win32.Generic.vc
FireEyeGeneric.mg.bdb792a57ce88caf
EmsisoftGen:Trojan.StartPage.1oLfaatVofmb (B)
SentinelOneStatic AI – Malicious PE
JiangminTrojan.Script.auat
AviraTR/Spy.Gen3
Antiy-AVLTrojan/Generic.ASCommon.FA
MicrosoftTrojan:Win32/Startpage.AGM
GDataWin32.Trojan.PSE.12FI8JT
AhnLab-V3Malware/Win.Generic.R444729
Acronissuspicious
McAfeeGenericRXAA-AA!BDB792A57CE8
MAXmalware (ai score=82)
VBA32Trojan.StartPage
MalwarebytesMalware.AI.135859893
PandaTrj/GdSda.A
TrendMicro-HouseCallTROJ_GEN.R03BC0DKC21
YandexPUA.Agent!K5pji3TV3sI
MaxSecureTrojan.Malware.300983.susgen
FortinetW32/CoinMiner.65CA!tr
AVGWin32:Adware-gen [Adw]

How to remove Malware.AI.135859893?

Malware.AI.135859893 removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment