Categories: Malware

Malware.AI.2019236193 (file analysis)

The Malware.AI.2019236193 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Malware.AI.2019236193 virus can do?

Behavioural detection: Executable code extraction – unpacking
Uses Windows utilities for basic functionality
Reads data out of its own binary image
The binary contains an unknown PE section name indicative of packing
The binary likely contains encrypted or compressed data.
The executable is likely packed with VMProtect
Authenticode signature is invalid
Behavioural detection: Injection (Process Hollowing)
Behavioural detection: Injection (inter-process)
CAPE detected the VMProtectStub malware family
Attempts to modify proxy settings
Deletes executed files from disk
Touches a file containing cookies, possibly for information gathering
Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Malware.AI.2019236193?


File Info:
name: EE235112623BA1619F9C.mlwpath: /opt/CAPEv2/storage/binaries/000441b52578cdef535bbf6d7136a9fda3158786cc2db2a2ebd0a13831ef8586crc32: 58E38782md5: ee235112623ba1619f9c1f71fdcff841sha1: e9262e97c74a0124385a3eac1b7941ea1f4963ecsha256: 000441b52578cdef535bbf6d7136a9fda3158786cc2db2a2ebd0a13831ef8586sha512: a7f666606505cb77dfec81f1d1e075838f79d93b9d184e2044ee55362484f509cf56a0ccace8b1f67f01335c29cde53f1086b1274f6d56c1ed7c35779a229255ssdeep: 12288:hY6Wla4ENyr1jYf0XWDAKyApJGwxnK6Wd2B8zthfnOHwvIqXv3HTaFzow:hFWENy57miAPXxKyiBhPSyPmKwtype: PE32 executable (console) Intel 80386, for MS Windowstlsh: T18FD423D57AC904F4DD4B237099A35D19B0FE68AD5B779C24C2DA82428E6C2EF106B3F4sha3_384: 5616d33755fa237ecb42ed41a0e649b13608ba81d6fd385417ca691367eb30e95ec6038257a3b580d92d1d99739f59d4ep_bytes: 9c882c24e8cc3100008d0593055300e8timestamp: 2010-11-08 13:12:00
Version Info:
0: [No Data]

Malware.AI.2019236193 also known as:

Bkav	W32.AIDetectMalware
Lionic	Riskware.Win32.Malicious.1!c
tehtris	Generic.Malware
ClamAV	Win.Backdoor.Ketrican-10007287-0
Skyhigh	BehavesLike.Win32.Dropper.jc
Malwarebytes	Malware.AI.2019236193
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Riskware ( 0040eff71 )
K7GW	Riskware ( 0040eff71 )
Cybereason	malicious.7c74a0
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
APEX	Malicious
Cynet	Malicious (score: 100)
Avast	Win32:Malware-gen
F-Secure	Heuristic.HEUR/AGEN.1339120
Trapmine	malicious.moderate.ml.score
FireEye	Generic.mg.ee235112623ba161
Sophos	Mal/VMProtBad-A
Google	Detected
Avira	HEUR/AGEN.1339120
MAX	malware (ai score=99)
Antiy-AVL	Trojan[Backdoor]/Win32.Bladabindi
Kingsoft	malware.kb.b.857
Microsoft	Backdoor:Win32/Bladabindi!ml
AhnLab-V3	Malware/Win32.Generic.C4069705
McAfee	Artemis!EE235112623B
VBA32	BScope.Trojan.Zpevdo
Cylance	unsafe
TrendMicro-HouseCall	TROJ_GEN.R002H0CGN23
Rising	Trojan.Generic@AI.100 (RDML:1Lo/uxAVrXkdjVZOjgu2pQ)
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/VMProtBad.A
AVG	Win32:Malware-gen
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_100% (W)