Categories: Malware

Should I remove “Malware.AI.1506365353”?

The Malware.AI.1506365353 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Malware.AI.1506365353 virus can do?

  • Executable code extraction
  • Creates RWX memory
  • Attempts to connect to a dead IP:Port (15 unique times)
  • Drops a binary and executes it
  • HTTP traffic contains suspicious features which may be indicative of malware related traffic
  • Performs some HTTP requests
  • Unconventionial language used in binary resources: Estonian
  • The binary likely contains encrypted or compressed data.
  • Uses Windows utilities for basic functionality
  • A process attempted to delay the analysis task by a long amount of time.
  • Installs itself for autorun at Windows startup
  • Creates a copy of itself
  • Attempts to create or modify system certificates
  • Anomalous binary characteristics

Related domains:

z.whorecord.xyz
a.tomx.xyz
milliondollarincomes.com
www.danielapintusarte.it
www.ppl-wales.co.uk
www.bethelholidayhomes.co.za
trophyindia.in
www.imeppmetalurgica.com.br
melkenpuur.com
www.melkenpuur.com
www.zowp.ir
www.agripet.be
sqs.ba
www.westernfertility.com
mcdowellnews.com
bigdataconsulting.fr
www.unaprcm.org

How to determine Malware.AI.1506365353?


File Info:

crc32: 9E2F0B05md5: f3e08bf2080fee0829ee987dec248045name: F3E08BF2080FEE0829EE987DEC248045.mlwsha1: faa0a0a2160752fd28c3ee2d35821fd02cfb024dsha256: 15b89cfb7395c51a6dbf8be7a57772546b090c6cbcd86af574835b95dcb7f40asha512: 1f5e66b08aabb35f8032a2e89dbca9ed0c30ae41688bc9585f8f46e8123403eea678bd70678f2eb9b590198f99ef2e3e003121261560312cdb3595f0fff88a0cssdeep: 6144:G6kXLLyq01xyX67ZsagKPCZfRo3CsLUyi:JkXXn01xF2alwo3C4Uytype: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

LegalCopyright: Copyright (C) 2017, hollecurProductVersion: 3.7.9Translation: 0x0809 0x04b0

Malware.AI.1506365353 also known as:

Bkav W32.AIDetect.malware1
Lionic Trojan.Multi.Generic.4!c
Elastic malicious (high confidence)
DrWeb Trojan.PWS.Stealer.24300
ClamAV Win.Malware.Dcgj-9847380-0
CAT-QuickHeal Trojan.Chapak.ZZ5
ALYac Trojan.Ransom.GandCrab
Cylance Unsafe
Zillya Trojan.Agent.Win32.914847
Sangfor Trojan.Win32.Save.a
CrowdStrike win/malicious_confidence_100% (W)
Alibaba Trojan:Win32/Kryptik.959a315c
K7GW Trojan ( 0053bfbf1 )
K7AntiVirus Trojan ( 0053bfbf1 )
Symantec Packed.Generic.525
ESET-NOD32 a variant of Win32/Kryptik.GJGO
APEX Malicious
Avast Win32:MalwareX-gen [Trj]
Cynet Malicious (score: 100)
Kaspersky HEUR:Trojan.Win32.Generic
BitDefender Trojan.Agent.DCGJ
NANO-Antivirus Trojan.Win32.Kryptik.ffzpcx
MicroWorld-eScan Trojan.Agent.DCGJ
Tencent Malware.Win32.Gencirc.10b819b6
Ad-Aware Trojan.Agent.DCGJ
Sophos Mal/Generic-S
Comodo TrojWare.Win32.Vigorf.B@7rh34e
BitDefenderTheta Gen:NN.ZexaF.34170.ty0@aqZbD9aI
VIPRE Trojan.Win32.Generic!BT
TrendMicro Ransom_GANDCRAB.SMALY-3
McAfee-GW-Edition BehavesLike.Win32.Generic.fh
FireEye Generic.mg.f3e08bf2080fee08
Emsisoft Trojan.Agent.DCGJ (B)
SentinelOne Static AI – Suspicious PE
Jiangmin Trojan.Blocker.itb
Webroot W32.Adware.Installcore
Avira HEUR/AGEN.1102792
eGambit Unsafe.AI_Score_99%
Antiy-AVL Trojan/Generic.ASMalwS.27111CC
Microsoft Trojan:Win32/Gandcrab.AF
GData Trojan.Agent.DCGJ
AhnLab-V3 Win-Trojan/Gandcrab04.Exp
Acronis suspicious
McAfee Packed-FJN!F3E08BF2080F
MAX malware (ai score=100)
VBA32 BScope.Trojan.Chapak
Malwarebytes Malware.AI.1506365353
Panda Trj/GdSda.A
TrendMicro-HouseCall Ransom_GANDCRAB.SMALY-3
Rising Trojan.Generic@ML.100 (RDML:gwcOgks7wXKTy4jRwoxoHg)
Yandex Trojan.Agent!SatH2JaHPXo
Ikarus Trojan.Win32.Crypt
MaxSecure Ransomeware.GandCrypt.Gen
Fortinet W32/GenKryptik.CGIW!tr
AVG Win32:MalwareX-gen [Trj]
Paloalto generic.ml

How to remove Malware.AI.1506365353?

  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.
Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Recent Posts

Worm.VobfusVMF.S19740081 information

The Worm.VobfusVMF.S19740081 is considered dangerous by lots of security experts. When this infection is active,…

1 min ago

Malware.AI.986323659 removal guide

The Malware.AI.986323659 is considered dangerous by lots of security experts. When this infection is active,…

13 mins ago

Generic.Dacic.1636.DB5B5110 removal

The Generic.Dacic.1636.DB5B5110 is considered dangerous by lots of security experts. When this infection is active,…

18 mins ago

Application.Application.Graftor.406603 (B) (file analysis)

The Application.Application.Graftor.406603 (B) is considered dangerous by lots of security experts. When this infection is…

27 mins ago

Generic.Dacic.1A7FA519.A.F5972732 removal instruction

The Generic.Dacic.1A7FA519.A.F5972732 is considered dangerous by lots of security experts. When this infection is active,…

37 mins ago

What is “Win32/AutoRun.VB.APK”?

The Win32/AutoRun.VB.APK is considered dangerous by lots of security experts. When this infection is active,…

37 mins ago