Malware

Malware.AI.1509253422 malicious file

Malware Removal

The Malware.AI.1509253422 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Malware.AI.1509253422 virus can do?

  • Behavioural detection: Executable code extraction – unpacking
  • SetUnhandledExceptionFilter detected (possible anti-debug)
  • Creates RWX memory
  • Possible date expiration check, exits too soon after checking local time
  • Dynamic (imported) function loading detected
  • Reads data out of its own binary image
  • The binary contains an unknown PE section name indicative of packing
  • Authenticode signature is invalid
  • Uses Windows utilities for basic functionality
  • Collects and encrypts information about the computer likely to send to C2 server
  • Likely virus infection of existing system binary

How to determine Malware.AI.1509253422?


File Info:

name: 5FD569A2D83EC314079C.mlw
path: /opt/CAPEv2/storage/binaries/8fd13f1c58f3195ab8b934ab51112d9c0a76f0138966929291c962046e814bb4
crc32: 2BD85D8B
md5: 5fd569a2d83ec314079c3ac732c983ab
sha1: 92148fc5642f63f6b15c9b097b50bddb620019b6
sha256: 8fd13f1c58f3195ab8b934ab51112d9c0a76f0138966929291c962046e814bb4
sha512: 0837320f5045bf22f00fa4fa05a604bc68112db5d840432d5518f91bd7581398cdb731784fb3c4f01ed02d470fa95981c1578bbbce3eb03dc318939bfed6a4e9
ssdeep: 196608:rLzQWELujyaJwfkacZDrXgjoC1VMu06ksKMVDZc05kyh9A/vymMVHUf:rXQjLQCffqrXgjR4VBWtc05kAA
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1F4A63303961A4C30F06D6E301DF2599991A02096B6F80EED7F1D3073AB39D995EAF637
sha3_384: 1d0e517a6a7393e4f8a775b6f704e21f5639f143ca664033ddce856b96d356f4f3884fd27ca630456176b8e407f9b02d
ep_bytes: 558bec83c4cc53565733c08945f08945
timestamp: 1992-06-19 22:22:17

Version Info:

Comments: This installation was built with Inno Setup.
CompanyName: Stradamus
FileDescription: Video Database 12
FileVersion: 1.0.2.9
LegalCopyright:
Translation: 0x0409 0x04e4

Malware.AI.1509253422 also known as:

LionicTrojan.Win32.Ekstak.4!c
McAfeeArtemis!5FD569A2D83E
CylanceUnsafe
AlibabaTrojanDropper:Win32/Ekstak.a5585e1f
K7GWTrojan ( 005722f11 )
K7AntiVirusTrojan ( 005722f11 )
CyrenW32/Ekstak.BY.gen!Eldorado
ESET-NOD32a variant of Win32/TrojanDropper.Agent.SLC
TrendMicro-HouseCallTROJ_GEN.R002H0DF122
KasperskyTrojan.Win32.Ekstak.ametx
AvastWin32:Trojan-gen
GDataWin32.Backdoor.Bodelph.RUA6UU
JiangminTrojan.Ekstak.bxwp
MicrosoftTrojan:Win32/Wacatac.B!ml
AhnLab-V3Adware/Win.Adware-gen.R495506
MalwarebytesMalware.AI.1509253422
TencentWin32.Trojan-dropper.Agent.Tbiz
AVGWin32:Trojan-gen

How to remove Malware.AI.1509253422?

Malware.AI.1509253422 removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment