Malware.AI.1406837904 information

Malware Removal

The Malware.AI.1406837904 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware - Review 2020

GridinSoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend to use GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the TRIAL period.
6-day free trial available.

What Malware.AI.1406837904 virus can do?

  • Executable code extraction
  • Attempts to connect to a dead IP:Port (3 unique times)
  • Creates RWX memory
  • At least one IP Address, Domain, or File Name was found in a crypto call
  • Reads data out of its own binary image
  • Performs some HTTP requests
  • Unconventionial language used in binary resources: Russian
  • The binary likely contains encrypted or compressed data.
  • Anomalous binary characteristics

Related domains:

z.whorecord.xyz
a.tomx.xyz
ipecho.net
158.102.105.176.zen.spamhaus.org
158.102.105.176.cbl.abuseat.org

How to determine Malware.AI.1406837904?


File Info:

crc32: 28792CAF
md5: b2c6937af062fa6bcdf9fa0319102232
name: B2C6937AF062FA6BCDF9FA0319102232.mlw
sha1: 8eeb851549df4b23de3d8793c9be90edc54f5f20
sha256: 4414280dee7e6b7724b395e8bc6aacf365424b1df90cd4240690f2b14841c8ab
sha512: 6af1077b0b5e45576ab0ddb526323e8375022c54753c31b15acdaa0432ed582b1ca1f75c5f4a4bf9e9bf02dafaba3fa5ab4c67fc016032d66e7d1fc9f2dcc92d
ssdeep: 12288:GqkpqeJ6oFDnJVs+3i83i4Bx+a/wiye17x:1KJJyB4ewwxeh
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

InternalName: ordinaryfits.exe
FileVersion: 136.0.50.391
CompanyName: Maras Group
ProductName: SQL Database
ProductVersion: 136.0.50.391
FileDescription: .NET Config File Wrapper
OriginalFilename: ordinaryfits.exe
Translation: 0x0000 0x04b0

Malware.AI.1406837904 also known as:

BkavW32.AIDetect.malware1
Elasticmalicious (high confidence)
DrWebTrojan.KillProc2.16003
CynetMalicious (score: 100)
CylanceUnsafe
SangforTrojan.Win32.Save.a
CrowdStrikewin/malicious_confidence_60% (D)
K7GWTrojan ( 0057c4c61 )
Cybereasonmalicious.549df4
ESET-NOD32a variant of Win32/GenKryptik.FFFT
APEXMalicious
AvastWin32:BankerX-gen [Trj]
KasperskyVHO:Trojan.Win32.Sdum.gen
BitDefenderTrojan.Agent.FHHS
MicroWorld-eScanTrojan.Agent.FHHS
Ad-AwareTrojan.Agent.FHHS
SophosML/PE-A
BitDefenderThetaGen:NN.ZexaF.34688.Du0@aakGLBhc
FireEyeGeneric.mg.b2c6937af062fa6b
EmsisoftTrojan.Agent.FHHS (B)
SentinelOneStatic AI – Suspicious PE
eGambitUnsafe.AI_Score_97%
MicrosoftTrojan:Script/Phonzy.B!ml
GridinsoftTrojan.Win32.Agent.oa!s1
ArcabitTrojan.Agent.FHHS
GDataTrojan.Agent.FHHS
MAXmalware (ai score=89)
MalwarebytesMalware.AI.1406837904
RisingTrojan.GenKryptik!8.AA55 (RDMK:cmRtazqSEZHNXSqniFW5JwfVDYpN)
FortinetW32/GenKryptik.FFFT!tr
AVGWin32:BankerX-gen [Trj]

How to remove Malware.AI.1406837904?

Malware.AI.1406837904 removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

Leave a Comment