Malware

How to remove “Malware.AI.1844014371”?

Malware Removal

The Malware.AI.1844014371 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Malware.AI.1844014371 virus can do?

  • SetUnhandledExceptionFilter detected (possible anti-debug)
  • Behavioural detection: Executable code extraction – unpacking
  • Yara rule detections observed from a process memory dump/dropped files/CAPE
  • Creates RWX memory
  • Possible date expiration check, exits too soon after checking local time
  • Dynamic (imported) function loading detected
  • Reads data out of its own binary image
  • CAPE extracted potentially suspicious content
  • Unconventionial language used in binary resources: Russian
  • The binary contains an unknown PE section name indicative of packing
  • The binary likely contains encrypted or compressed data.
  • The executable is compressed using UPX
  • Authenticode signature is invalid

How to determine Malware.AI.1844014371?


File Info:

name: C6AE6B0B867192B2D821.mlw
path: /opt/CAPEv2/storage/binaries/268730009852f122e6ef1fba1856444dc1e080987798533e76b64e9cac2dbfba
crc32: 89F7519E
md5: c6ae6b0b867192b2d82129382dce2d32
sha1: 6325e5abb753b9bd5c504359c2a4f8d078cafe65
sha256: 268730009852f122e6ef1fba1856444dc1e080987798533e76b64e9cac2dbfba
sha512: a950ec54a3e1f4021d843434a44a90f6ad261e0d30c4533787f75f5aaaa71eb4903b2a307952e81e1849658030973a4ad4c61f7e5990a12d9e42a47e23e8c6fd
ssdeep: 3072:7s0AVRygTfvxSmmRXUtbV/Sf0JPs3aZSCzy32w0:7s0oygTf45JUptSf06qZSOyW
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1AAE3F18372F83F05C57B2DFB32879A76C819415A252E60F9F3AE5384E9EDDA500A503C
sha3_384: 6ec797b7062aa6adab718531d9fb2e49b0a4b6b9bdfd01645510e65d7e158db0cbae34ddc4f3731170f5999e6e30e01d
ep_bytes: 60be153036018dbeebdf09ff57eb0b90
timestamp: 2008-10-07 09:43:10

Version Info:

0: [No Data]

Malware.AI.1844014371 also known as:

LionicTrojan.Win32.Zbot.l!c
Elasticmalicious (high confidence)
CynetMalicious (score: 100)
FireEyeGeneric.mg.c6ae6b0b867192b2
ALYacGen:Variant.Zbot.23
CylanceUnsafe
VIPREPacked.Win32.Zbot.gen.y.7 (v)
SangforTrojan.Win32.Save.a
K7AntiVirusRiskware ( 0015e4f01 )
AlibabaTrojanPSW:Win32/Kryptik.e40713db
K7GWRiskware ( 0015e4f01 )
Cybereasonmalicious.b86719
BitDefenderThetaAI:Packer.6A7E35801E
VirITTrojan.Win32.Cryptic.AZD
CyrenW32/Zbot.AU.gen!Eldorado
SymantecTrojan.Zbot
ESET-NOD32a variant of Win32/Kryptik.GWU
APEXMalicious
Paloaltogeneric.ml
ClamAVWin.Trojan.Zbot-66084
KasperskyHEUR:Trojan.Win32.Generic
BitDefenderGen:Variant.Zbot.23
NANO-AntivirusTrojan.Win32.Panda.bpzld
MicroWorld-eScanGen:Variant.Zbot.23
AvastWin32:Trojan-gen
TencentWin32.Trojan.Spy.Szlm
Ad-AwareGen:Variant.Zbot.23
EmsisoftGen:Variant.Zusy.345 (B)
ComodoMalware@#a2q7rre4am0d
DrWebTrojan.PWS.Panda.387
ZillyaTrojan.Kryptik.Win32.80364
TrendMicroMal_Zvrek3
McAfee-GW-EditionBehavesLike.Win32.ZBot.cc
SophosMal/Generic-R + Mal/Zbot-U
SentinelOneStatic AI – Malicious PE
GDataGen:Variant.Zbot.23
JiangminTrojan/Generic.bagv
WebrootW32.Malware.Gen
AviraTR/Spy.Zbot.acyp
MAXmalware (ai score=100)
Antiy-AVLTrojan[Packed]/Win32.Krap
ArcabitTrojan.Zbot.23
ViRobotTrojan.Win32.A.Zbot.145408.T
ZoneAlarmHEUR:Trojan.Win32.Generic
MicrosoftPWS:Win32/Zbot
AhnLab-V3Trojan/Win32.Zbot.R37324
McAfeePWS-Zbot.gen.pp
VBA32Trojan.Zeus.EA.0999
MalwarebytesMalware.AI.1844014371
TrendMicro-HouseCallMal_Zvrek3
RisingSpyware.Zbot!8.16B (CLOUD)
YandexTrojanSpy.Zbot!KFcNMfiv4R0
IkarusTrojan-Spy.Win32.Zbot
FortinetW32/Zbot.U!tr
AVGWin32:Trojan-gen
PandaTrj/Genetic.gen
CrowdStrikewin/malicious_confidence_90% (W)

How to remove Malware.AI.1844014371?

Malware.AI.1844014371 removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment