Malware

Malware.AI.1466678163 removal instruction

Malware Removal

The Malware.AI.1466678163 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Malware.AI.1466678163 virus can do?

  • SetUnhandledExceptionFilter detected (possible anti-debug)
  • Attempts to connect to a dead IP:Port (1 unique times)
  • Yara rule detections observed from a process memory dump/dropped files/CAPE
  • Dynamic (imported) function loading detected
  • Enumerates running processes
  • A process created a hidden window
  • Drops a binary and executes it
  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid
  • Steals private information from local Internet browsers
  • CAPE detected the Alfonoso malware family
  • Attempts to access Bitcoin/ALTCoin wallets
  • Harvests cookies for information gathering

How to determine Malware.AI.1466678163?


File Info:

name: 7D6C4E8875FBA2869178.mlw
path: /opt/CAPEv2/storage/binaries/29429e6721db77de6b6c91bc66f5bf7130afcfd3a1b540afaf4ab838817920e9
crc32: 982C174C
md5: 7d6c4e8875fba286917826a8170f242a
sha1: e299486cffa0445191b9fb35e9f171870750e580
sha256: 29429e6721db77de6b6c91bc66f5bf7130afcfd3a1b540afaf4ab838817920e9
sha512: f96ebdababff3c95838106401fa62d598aa278268d1fdb9d979032426fededb39921d2c4ada087737f3490875ebd86ada4450d56d95f8d68d1e8e88023a8d5e7
ssdeep: 12288:YIJPo5P9+6iwNUjk5DulD+78BflHnkzgKyaJAgpTmEH:g4UNUjUMqA7HbyAgZ/
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1E7C4E04479C1B0B6E57A3F701060A86912AE57600F679997EEC02FDC1E318E0FE5FB66
sha3_384: 4c7356c0d8f8bd6ff66da9766611f044d84d14f7f762e89ddba184de7d7bc6efe87ea68dcacf274477f10f77aad6a188
ep_bytes: e8b1020000e974feffff3b0d14504100
timestamp: 2022-01-11 23:05:42

Version Info:

0: [No Data]

Malware.AI.1466678163 also known as:

BkavW32.AIDetect.malware1
LionicTrojan.Win32.Matanbuchus.4!c
Elasticmalicious (high confidence)
FireEyeGeneric.mg.7d6c4e8875fba286
McAfeeRDN/Generic.rp
CylanceUnsafe
SangforSuspicious.Win32.Save.a
AlibabaTrojan:Win32/Matanbuchus.66bf457c
Cybereasonmalicious.cffa04
SymantecML.Attribute.HighConfidence
ESET-NOD32a variant of Generik.GXOWPPO
APEXMalicious
Paloaltogeneric.ml
CynetMalicious (score: 100)
KasperskyHEUR:Trojan.Win32.Matanbuchus.gen
BitDefenderTrojan.GenericKD.47914842
MicroWorld-eScanTrojan.GenericKD.47914842
AvastWin32:Trojan-gen
RisingStealer.Hunter!8.122F9 (CLOUD)
Ad-AwareTrojan.GenericKD.47914842
EmsisoftTrojan.GenericKD.47914842 (B)
DrWebTrojan.PWS.Siggen3.10300
TrendMicroTROJ_GEN.R011C0PAF22
McAfee-GW-EditionBehavesLike.Win32.Generic.hc
SophosMal/Generic-S
IkarusTrojan-Spy.Win32.PSWSteal
GDataTrojan.GenericKD.47914842
WebrootW32.Matanbuchus
AviraHEUR/AGEN.1130812
GridinsoftRansom.Win32.Sabsik.sa
ArcabitTrojan.Generic.D2DB1F5A
MicrosoftTrojan:Win32/Sabsik.FL.B!ml
Acronissuspicious
BitDefenderThetaGen:NN.ZexaF.34160.JuW@a4GpWwli
MAXmalware (ai score=85)
VBA32Trojan.Matanbuchus
MalwarebytesMalware.AI.1466678163
TrendMicro-HouseCallTROJ_GEN.R011C0PAF22
TencentWin32.Trojan.Matanbuchus.Ajvw
SentinelOneStatic AI – Malicious PE
FortinetW32/PossibleThreat
AVGWin32:Trojan-gen
PandaTrj/GdSda.A
CrowdStrikewin/malicious_confidence_70% (W)

How to remove Malware.AI.1466678163?

Malware.AI.1466678163 removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment