Malware

Malware.AI.1761762628 removal guide

Malware Removal

The Malware.AI.1761762628 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Malware.AI.1761762628 virus can do?

  • Behavioural detection: Executable code extraction – unpacking
  • SetUnhandledExceptionFilter detected (possible anti-debug)
  • Creates RWX memory
  • Possible date expiration check, exits too soon after checking local time
  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid

How to determine Malware.AI.1761762628?


File Info:

name: B179CC78A21A4205C03C.mlw
path: /opt/CAPEv2/storage/binaries/7ab8469cddb5ada465ea325a857ecf3ef74057d340d9584fda7d944971802fb3
crc32: 9B652A3D
md5: b179cc78a21a4205c03cea7a1720c9a1
sha1: 00dfee2c7798a4d8a403d83539e9f63637899079
sha256: 7ab8469cddb5ada465ea325a857ecf3ef74057d340d9584fda7d944971802fb3
sha512: 0830bbb74c9dec66bad04dc58ba06920a4a3d85cd14a63630faefc94fd85d7f690bfecd184e3a0096d3f79da095aa721de23a7cbbd87545e2fa42db741fe7af3
ssdeep: 12288:mr1yKsyLdi6zUaCSE2FWb5RdXxXNDg9fqpObXDlL:mr1yKsyL1RCSy1LxWfqYtL
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1AB947D82A34905C0FFB8FD725A76BB0BE079026DEE54D94C5C99FC3F08B9A8D64484D9
sha3_384: e40c06960685a0a201e93137f4faed0307187a9c68e8ee03b6bc12665bd6ef6c936110f308bba379b7dfab91594031b0
ep_bytes: 5150528d0d18000000648b0101c801c8
timestamp: 2009-10-18 20:28:07

Version Info:

CompanyName: Microsoft Corporation
FileDescription: Host Process for Windows Services
FileVersion: 6.1.7600.16385 (win7_rtm.090713-1255)
InternalName: svchost.exe
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFilename: svchost.exe
ProductName: Microsoft® Windows® Operating System
ProductVersion: 6.1.7600.16385
Translation: 0x0409 0x04b0

Malware.AI.1761762628 also known as:

BkavW32.AIDetect.malware2
LionicTrojan.Win32.Expiro.4!c
Elasticmalicious (high confidence)
MicroWorld-eScanWin32.Expiro.Gen.6
FireEyeGeneric.mg.b179cc78a21a4205
CylanceUnsafe
SangforTrojan.Win32.Save.a
K7AntiVirusTrojan ( 00561cbf1 )
Cybereasonmalicious.8a21a4
CyrenW32/Expiro.AN.gen!Eldorado
SymantecML.Attribute.HighConfidence
ESET-NOD32a variant of Win32/Expiro.NDG
APEXMalicious
Paloaltogeneric.ml
BitDefenderWin32.Expiro.Gen.6
NANO-AntivirusVirus.Win32.Gen.ccmw
SUPERAntiSpywareTrojan.Agent/Gen-Injector
AvastWin32:Xpirat-C [Inf]
TencentVirus.Win32.Expiro.ns
Ad-AwareWin32.Expiro.Gen.6
EmsisoftWin32.Expiro.Gen.6 (B)
McAfee-GW-EditionBehavesLike.Win32.Virut.gc
SophosML/PE-A + Mal/EncPk-MK
SentinelOneStatic AI – Malicious PE
GDataWin32.Expiro.Gen.6
AviraTR/Patched.Gen
GridinsoftRansom.Win32.Wacatac.sa
MicrosoftTrojan:Win32/Raccoon.EC!MTB
CynetMalicious (score: 100)
Acronissuspicious
ALYacWin32.Expiro.Gen.6
MAXmalware (ai score=81)
VBA32BScope.Trojan.Wacatac
MalwarebytesMalware.AI.1761762628
IkarusVirus.Win32.Expiro
FortinetW32/Expiro.NDG
AVGWin32:Xpirat-C [Inf]
CrowdStrikewin/malicious_confidence_90% (W)

How to remove Malware.AI.1761762628?

Malware.AI.1761762628 removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment