Malware

Malware.AI.2071046737 removal guide

Malware Removal

The Malware.AI.2071046737 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Malware.AI.2071046737 virus can do?

  • Behavioural detection: Executable code extraction – unpacking
  • Sample contains Overlay data
  • Uses Windows utilities for basic functionality
  • CAPE extracted potentially suspicious content
  • The binary contains an unknown PE section name indicative of packing
  • The binary likely contains encrypted or compressed data.
  • The executable is compressed using UPX
  • Authenticode signature is invalid
  • Uses Windows utilities to create a scheduled task
  • Creates a copy of itself
  • Deletes executed files from disk
  • Uses suspicious command line tools or Windows utilities
  • Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Malware.AI.2071046737?


File Info:

name: 6EA1921B4756C4868CAB.mlw
path: /opt/CAPEv2/storage/binaries/06d1bfe3216188c15fb363c5601b4c854340252ef96561205ce8c20d6c19b832
crc32: 2EE36BFE
md5: 6ea1921b4756c4868cab3d9c8a654d2a
sha1: 03364c40d658b6c7b56b226bcbb01f1550a07e6a
sha256: 06d1bfe3216188c15fb363c5601b4c854340252ef96561205ce8c20d6c19b832
sha512: 522df405c8f577962257e57005986ae4d083929269cb26e88d14c5607b100a8cb0796797d1e6bd83e1b8e22c940bbf1125ae006dc1471c4783b830b8cfee4265
ssdeep: 49152:3ZMDDgOS2aK2GDn0FdJM7+8+NVQ1l42xeJcmq3A2mdJ1jfNy2iTvNJhaK2Y:JItWcmq3fmdHZ7ibNJT
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1F1166C3271B15169E06F1132525E766711F9CBD38CE7DB5B682BC2B06BA318CAFA3503
sha3_384: bb60921013683bb9205475addd2c0992a28d5f978d3b6f814131fc9e057511dc999782b87f53c353ff65ed0a7049ce82
ep_bytes: 68000000005b5029f65a89f65209fe21
timestamp: 1970-01-01 00:00:00

Version Info:

0: [No Data]

Malware.AI.2071046737 also known as:

BkavW32.AIDetectMalware
tehtrisGeneric.Malware
MicroWorld-eScanGen:Trojan.Heur.TP.@pZ@bmkYIlj
FireEyeGeneric.mg.6ea1921b4756c486
MalwarebytesMalware.AI.2071046737
SangforSuspicious.Win32.Save.a
K7AntiVirusTrojan ( 004bcce41 )
BitDefenderGen:Trojan.Heur.TP.@pZ@bmkYIlj
K7GWTrojan ( 004bcce41 )
CrowdStrikewin/malicious_confidence_100% (D)
SymantecML.Attribute.HighConfidence
Elasticmalicious (high confidence)
ESET-NOD32a variant of Win32/Injector.EAHK
APEXMalicious
KasperskyVHO:Trojan.Win32.Khalesi.gen
NANO-AntivirusTrojan.Win32.Packed2.kcqgtf
RisingTrojan.Injector!1.C865 (CLASSIC)
SophosMal/TibsPak
F-SecureTrojan.TR/Crypt.ULPM.Gen
DrWebTrojan.Packed2.43250
VIPREGen:Trojan.Heur.TP.@pZ@bmkYIlj
EmsisoftGen:Trojan.Heur.TP.@pZ@bmkYIlj (B)
IkarusTrojan.Win32.Injector
JiangminTrojan.Generic.hbeyb
GoogleDetected
AviraTR/Crypt.ULPM.Gen
VaristW32/Copak.F.gen!Eldorado
Antiy-AVLTrojan/Win32.Injector
MicrosoftTrojan:Win32/Injector.RAQ!MTB
XcitiumPacked.Win32.MUPX.Gen@24tbus
ArcabitTrojan.Heur.TP.EDD7EB
ZoneAlarmVHO:Trojan.Win32.Khalesi.gen
GDataGen:Trojan.Heur.TP.@pZ@bmkYIlj
CynetMalicious (score: 100)
AhnLab-V3Malware/Win32.RL_Generic.R363534
BitDefenderThetaAI:Packer.F1613FA91E
ALYacGen:Trojan.Heur.TP.@pZ@bmkYIlj
MAXmalware (ai score=84)
VBA32BScope.Trojan.Wacatac
Cylanceunsafe
PandaTrj/Genetic.gen
SentinelOneStatic AI – Malicious PE
FortinetW32/Kryptik.EAHK!tr
AVGWin32:Evo-gen [Trj]
Cybereasonmalicious.0d658b
AvastWin32:Evo-gen [Trj]

How to remove Malware.AI.2071046737?

Malware.AI.2071046737 removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment