Malware

Malware.AI.1980174229 removal guide

Malware Removal

The Malware.AI.1980174229 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Malware.AI.1980174229 virus can do?

  • At least one IP Address, Domain, or File Name was found in a crypto call
  • Expresses interest in specific running processes
  • Reads data out of its own binary image
  • Drops a binary and executes it
  • The binary likely contains encrypted or compressed data.
  • The executable is compressed using UPX
  • Uses Windows utilities for basic functionality
  • Attempts to repeatedly call a single API many times in order to delay analysis time
  • Installs itself for autorun at Windows startup
  • Network activity detected but not expressed in API logs
  • Creates a copy of itself

Related domains:

z.whorecord.xyz
a.tomx.xyz

How to determine Malware.AI.1980174229?


File Info:

crc32: 3397C396
md5: 107125b21ead98074afffafa2bb3da06
name: 107125B21EAD98074AFFFAFA2BB3DA06.mlw
sha1: 86fe3371e78281d8cbdd81330148238abb4a3e0d
sha256: a0c6133a6826059b6add3a24afe141b817cff14fb0bfc7dade7ec230822d56fe
sha512: f7767d490ab9aee647f6cf02c2eaf9eea88994d2070d20f9da14737e2c923aecd461e71d5531d41cf865f5a5bc0c9cef1ca14f6503ad5bb9ad5852b24717a58c
ssdeep: 12288:5Bw4tn8y3AGmEvX+3IdpvX5E6opcLyXTHAgxSSQAHDS:XFtNfmEvX+i/hopIyDVhHO
type: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed

Version Info:

Translation: 0x0809 0x04b0

Malware.AI.1980174229 also known as:

BkavW32.AIDetect.malware2
K7AntiVirusRiskware ( 0040eff71 )
LionicWorm.Win32.Generic.o!c
DrWebTrojan.Encoder.7161
ClamAVWin.Ransomware.Stampado-9796884-0
CAT-QuickHealRansom.Autoit.Stampado.A
McAfeeArtemis!107125B21EAD
CylanceUnsafe
ZillyaWorm.Filecoder.Win32.139
AlibabaTrojan:Win32/Starter.ali1001008
K7GWRiskware ( 0040eff71 )
Cybereasonmalicious.21ead9
SymantecML.Attribute.HighConfidence
ESET-NOD32a variant of Win32/Filecoder.Philadelphia.G
APEXMalicious
AvastINF:AutoRun-BI [Wrm]
CynetMalicious (score: 100)
KasperskyHEUR:Worm.Script.Generic
BitDefenderGeneric.Ransom.Stampado.69B659C7
NANO-AntivirusTrojan.Script.AuVir.ekpekr
MicroWorld-eScanGeneric.Ransom.Stampado.69B659C7
TencentWin32.Trojan.Generic.Dvpp
Ad-AwareGeneric.Ransom.Stampado.69B659C7
SophosTroj/Stampado-A
ComodoMalware@#3sra1vcnht730
BitDefenderThetaAI:Packer.618F1AC817
VIPRETrojan.Win32.Generic.pak!cobra
TrendMicroRansom_STAMPADO.F116KS
McAfee-GW-EditionBehavesLike.Win32.TrojanAitInject.hc
FireEyeGeneric.Ransom.Stampado.69B659C7
EmsisoftGeneric.Ransom.Stampado.69B659C7 (B)
AviraDR/AutoIt.Gen
eGambitUnsafe.AI_Score_68%
MicrosoftRansom:Win32/Stampado.A
ArcabitGeneric.Ransom.Stampado.69B659C7
ZoneAlarmHEUR:Worm.Script.Generic
GDataGeneric.Ransom.Stampado.69B659C7 (3x)
AhnLab-V3Malware/Win32.Ransom_.C1691577
VBA32Trojan.Encoder
MAXmalware (ai score=81)
MalwarebytesMalware.AI.1980174229
PandaTrj/CI.A
TrendMicro-HouseCallRansom_STAMPADO.F116KS
RisingRansom.Philadelphia/Autoit!1.BA48 (CLASSIC)
YandexTrojan.Agent!ufYGmkwcXGU
IkarusWorm.Win32.Filecoder
MaxSecureTrojan.Malware.300983.susgen
FortinetAutoIt/Philadelphia.E!tr
AVGINF:AutoRun-BI [Wrm]
Paloaltogeneric.ml

How to remove Malware.AI.1980174229?

Malware.AI.1980174229 removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment