Malware

Malware.AI.1870037498 information

Malware Removal

The Malware.AI.1870037498 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Malware.AI.1870037498 virus can do?

  • SetUnhandledExceptionFilter detected (possible anti-debug)
  • Dynamic (imported) function loading detected
  • Reads data out of its own binary image
  • CAPE extracted potentially suspicious content
  • Unconventionial binary language: Polish
  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid
  • Installs itself for autorun at Windows startup
  • Anomalous binary characteristics

How to determine Malware.AI.1870037498?


File Info:

name: ECF95B48E6D71B1D0310.mlw
path: /opt/CAPEv2/storage/binaries/efef0bdc3d14a08d98ab7923403c64bb4df9088aeb19cf45884937cd9b1e6084
crc32: 58444B57
md5: ecf95b48e6d71b1d031051be77a3ef56
sha1: 3da4be98bc6bdba0df2793854b892e61a14a301b
sha256: efef0bdc3d14a08d98ab7923403c64bb4df9088aeb19cf45884937cd9b1e6084
sha512: 9fcd95ecd1805e5290d0c596d8997ac915d66d838a2685d5ede9ed76f201b989716e4552aa2f7c85a704c1f9bc38d2cf519031243249739885711bb70453472a
ssdeep: 196608:rbDEkn98Sha7NC/aVs2eXUoxeUNsyu9hzKXTa8:rbDV9pk7NLaUoxRsTE
type: PE32+ executable (GUI) x86-64, for MS Windows
tlsh: T16A76338286EE487EF4719B7276B352A21937BC1A7F35D1EF0145D01E1622B82BF76321
sha3_384: dc01d2ad4d2ec523ee08377cb10e726bf274e2a333d8f81ef1c832ba6e74ff49940a4fc877498683b364aa84420ccec5
ep_bytes: 4883ec28e85b0700004883c428e90600
timestamp: 1990-07-21 04:22:47

Version Info:

CompanyName: Microsoft Corporation
FileDescription: Win32 Cabinet Self-Extractor
FileVersion: 11.00.18362.1440 (WinBuild.160101.0800)
InternalName: Wextract
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFilename: WEXTRACT.EXE .MUI
ProductName: Internet Explorer
ProductVersion: 11.00.18362.1440
Translation: 0x0809 0x04b0

Malware.AI.1870037498 also known as:

LionicTrojan.NSIS.Agent.b!c
DrWebTrojan.MinerNET.19
MicroWorld-eScanTrojan.GenericKD.36646246
FireEyeGeneric.mg.ecf95b48e6d71b1d
McAfeeArtemis!ECF95B48E6D7
CylanceUnsafe
ZillyaTrojan.Cryptos.Win32.8289
SangforRiskware.Win32.Agent.ky
K7AntiVirusTrojan ( 0057c5581 )
AlibabaTrojan:Win32/Agenb.486cf095
K7GWTrojan ( 0057c5581 )
Cybereasonmalicious.8bc6bd
CyrenW64/MSIL_Kryptik.FDB.gen!Eldorado
SymantecTrojan.Gen.2
ESET-NOD32multiple detections
TrendMicro-HouseCallTROJ_GEN.R011C0GDJ21
Paloaltogeneric.ml
ClamAVWin.Trojan.CoinMiner-9851722-1
KasperskyUDS:DangerousObject.Multi.Generic
BitDefenderTrojan.GenericKD.36646246
NANO-AntivirusTrojan.Win64.Cryptos.iuctpo
AvastWin64:CoinminerX-gen [Trj]
TencentMsil.Trojan.Cryptos.Apmv
Ad-AwareTrojan.GenericKD.36646246
SophosMal/Generic-S
VIPRETrojan.Win32.Generic!BT
TrendMicroTROJ_GEN.R011C0GDJ21
McAfee-GW-EditionNSIS/Dropper.ad
EmsisoftTrojan.GenericKD.36646246 (B)
SentinelOneStatic AI – Malicious SFX
GDataTrojan.GenericKD.36646246
MaxSecureTrojan.Malware.1728101.susgen
AviraTR/CoinMiner.lqzyq
MAXmalware (ai score=84)
Antiy-AVLTrojan/Generic.ASMalwS.31FBA40
MicrosoftTrojan:Win32/Tiggre!rfn
CynetMalicious (score: 100)
ALYacTrojan.GenericKD.36646246
MalwarebytesMalware.AI.1870037498
APEXMalicious
RisingDropper.Agent/NSIS!1.D57D (CLASSIC)
eGambitUnsafe.AI_Score_99%
FortinetW32/Cryptos.BIP!tr
WebrootW32.Trojan.Gen
AVGWin64:CoinminerX-gen [Trj]
PandaTrj/CI.A

How to remove Malware.AI.1870037498?

Malware.AI.1870037498 removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment