Should I remove “Malware.AI.1813059164”?

The Malware.AI.1813059164 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Malware.AI.1813059164 virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Possible date expiration check, exits too soon after checking local time
• Anomalous file deletion behavior detected (10+)
• Dynamic (imported) function loading detected
• At least one IP Address, Domain, or File Name was found in a crypto call
• Starts servers listening on 0.0.0.0:13684, :0
• Enumerates running processes
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Uses Windows utilities for basic functionality
• Code injection with CreateRemoteThread in a remote process
• Behavioural detection: Injection (inter-process)
• Behavioural detection: Injection with CreateRemoteThread in a remote process
• Tries to unhook or modify Windows functions monitored by Cuckoo
• Steals private information from local Internet browsers
• Collects and encrypts information about the computer likely to send to C2 server
• Installs itself for autorun at Windows startup
• Exhibits behavior characteristics of BlackRemote/BlackRAT RAT
• Creates a hidden or system file
• Attempts to modify browser security settings
• Collects information to fingerprint the system
• Anomalous binary characteristics
• Clears web history

How to determine Malware.AI.1813059164?

File Info:
name: EC303DF5BD6B45C1730A.mlw
path: /opt/CAPEv2/storage/binaries/916e863efb9547dd28b2004ff1e2846b504aa822948772a825652421ffd0a7f9
crc32: 25C3358A
md5: ec303df5bd6b45c1730a08764c011d93
sha1: 48ec4a0ee0923f1c0923f7d07348db4805b356a5
sha256: 916e863efb9547dd28b2004ff1e2846b504aa822948772a825652421ffd0a7f9
sha512: 702c3284fe975560836892905db4e226af37372ea471cf0f9c776390b69a75a99f6ac7eaaebcbc0f86fb34dac7357f03e8c0232a5de0819bae0eb73ba260f8af
ssdeep: 6144:r2e5JKZAfpkRyyOsku63E8L4lH591U0+K5lK243rf7M32glZa6QhvJ:r2e5JK2Oku6IH59K0TK2KrfQGD
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T12374E0D062A7B5C5F0B2EB7C5C6371D0B965E871EF2CC9CA1FC0654D587EA408A21A2F
sha3_384: c9cbfc54d13b3cab88cf619e05fbd29d2f74ad2f4a199fd5b048ea44504b112fafe60698bd2c07f57e7909b5d4d90e01
ep_bytes: b83e1f4000ffe0558bec83ec08c745f8
timestamp: 1970-01-01 00:00:00

Version Info:
CompanyName: Microsoft Corporation
FileDescription: Internet Ratings and Local User Management DLL
FileVersion: 6.00.2600.0000 (xpclient.010817-1148)
InternalName: MSRATING
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFilename: MSRATING.DLL
ProductName: Microsoft® Windows® Operating System
ProductVersion: 6.00.2600.0000
OleSelfRegister: 
Translation: 0x0409 0x04b0

Malware.AI.1813059164 also known as:

How to remove Malware.AI.1813059164?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.