Malware

Malware.AI.1782745671 malicious file

Malware Removal

The Malware.AI.1782745671 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Malware.AI.1782745671 virus can do?

  • Behavioural detection: Executable code extraction – unpacking
  • CAPE extracted potentially suspicious content
  • Drops a binary and executes it
  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid
  • CAPE detected the RedLine malware family
  • Deletes executed files from disk
  • Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Malware.AI.1782745671?


File Info:

name: 72D6770A94375C6020E6.mlw
path: /opt/CAPEv2/storage/binaries/26cdd859b54246ebca68578abe4d12f7834f20bc2f5393eeab254a3231ebc8be
crc32: 53F14556
md5: 72d6770a94375c6020e617f4d5744631
sha1: 55c3628be3d4347f7dc0922d58037760b9cedf09
sha256: 26cdd859b54246ebca68578abe4d12f7834f20bc2f5393eeab254a3231ebc8be
sha512: 0eada427ea393386ee4b19231f65f773f4c1c077760683e14e8802320d873c96a3dd09b8f04b411cd3868b6da8254f53dfe3988ca0a872c3161cd01a2249ba28
ssdeep: 12288:cy90FyKZqLtf1HmKFxYYlniIVdUNRcgjbPBLBaslY:cylF12YlTdU3dbvlY
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1AEB40203B6E84032DCF557B048FA16930B3A7DA15B7487AB37495AA94CB36D4E43137B
sha3_384: 541b1393c8d9575fe234170876692ea894666ab221c5b72aa24d902a537380c8df3bb8b459b65ced12efc9552f8a795f
ep_bytes: e803070000e905000000cccccccccc6a
timestamp: 2016-07-16 01:42:10

Version Info:

CompanyName: Microsoft Corporation
FileDescription: Win32 Cabinet Self-Extractor
FileVersion: 11.00.14393.0 (rs1_release.160715-1616)
InternalName: Wextract
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFilename: WEXTRACT.EXE .MUI
ProductName: Internet Explorer
ProductVersion: 11.00.14393.0
Translation: 0x0409 0x04b0

Malware.AI.1782745671 also known as:

Elasticmalicious (high confidence)
MicroWorld-eScanGen:Variant.Zusy.456486
ClamAVWin.Packed.Disabler-9997785-0
ALYacGen:Variant.Zusy.456486
MalwarebytesMalware.AI.1782745671
VIPREGen:Variant.Zusy.456486
CrowdStrikewin/malicious_confidence_60% (D)
K7GWTrojan ( 0059e4881 )
K7AntiVirusTrojan ( 0059e4881 )
CyrenW32/ABRisk.FJMM-2491
ESET-NOD32multiple detections
APEXMalicious
CynetMalicious (score: 99)
KasperskyHEUR:Trojan.Win32.Generic
AvastWin32:TrojanX-gen [Trj]
F-SecureHeuristic.HEUR/AGEN.1323756
TrendMicroTrojanSpy.Win32.REDLINE.YXDDYZ
McAfee-GW-EditionBehavesLike.Win32.AgentTesla.gc
SentinelOneStatic AI – Malicious SFX
AviraHEUR/AGEN.1323756
Antiy-AVLTrojan[Backdoor]/Win32.Convagent
ZoneAlarmHEUR:Trojan.Win32.Generic
MicrosoftTrojan:Win32/Wacatac.B!ml
GoogleDetected
McAfeeArtemis!2B71F4B18AC8
TrendMicro-HouseCallTrojanSpy.Win32.REDLINE.YXDDYZ
RisingTrojan.Kryptik!1.E4D1 (CLASSIC:RPQYZl22FdXVL76orHsHRQ)
IkarusTrojan-Spy.Amedy
FortinetMSIL/Disabler.DR!tr
AVGWin32:TrojanX-gen [Trj]

How to remove Malware.AI.1782745671?

Malware.AI.1782745671 removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment