Malware

Malware.AI.217794152 removal instruction

Malware Removal

The Malware.AI.217794152 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Malware.AI.217794152 virus can do?

  • Yara rule detections observed from a process memory dump/dropped files/CAPE
  • Dynamic (imported) function loading detected
  • Performs HTTP requests potentially not found in PCAP.
  • Enumerates running processes
  • Expresses interest in specific running processes
  • Reads data out of its own binary image
  • Drops a binary and executes it
  • The binary contains an unknown PE section name indicative of packing
  • The binary likely contains encrypted or compressed data.
  • The executable is compressed using UPX
  • Authenticode signature is invalid
  • Created a process from a suspicious location
  • Installs itself for autorun at Windows startup
  • Attempts to modify proxy settings

How to determine Malware.AI.217794152?


File Info:

name: 9C714A868E93E7DF39BA.mlw
path: /opt/CAPEv2/storage/binaries/bf07d3b852c74b4f0db0c754937be5d2681b63e987945f590b9beabf3e20b768
crc32: 69B050B1
md5: 9c714a868e93e7df39babe6a5d4355f1
sha1: c4138f6f6addbf3b26f85228ed47977c02340a87
sha256: bf07d3b852c74b4f0db0c754937be5d2681b63e987945f590b9beabf3e20b768
sha512: ecaacba24742b7c98288ce3b4fd5421ced2494b91592c09ad3851dd6290ae0841acb98a4f51c207e67732f76c9834e530fe80e302fb43c368c7e0f0d852a2764
ssdeep: 1536:7k3atxsAb6CIkFcFqAfO6KLZeXC0QFPVnILF7GTHFs44lOXdDIk4lzIOAvXdnKSS:7B2FRKcQA7hQFP1AsFkl4dDl4lzIOAvC
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T114930215AF3CAB0ED00B2676D591C3EED840B2E1986990CE1C382A5C125B9EF135E76E
sha3_384: 3b58b51f082ff94d87675ee6173254fed47b8a1c05c3f25f569e57d4bebdf5538daaa2486d7bf18bcd5ac480872e3175
ep_bytes: 60be009046008dbe0080f9ff57eb0b90
timestamp: 2015-01-22 23:23:23

Version Info:

0: [No Data]

Malware.AI.217794152 also known as:

tehtrisGeneric.Malware
DrWebBackDoor.Bifrost.29319
MicroWorld-eScanGeneric.Dacic.EA08C894.A.100E1680
FireEyeGeneric.mg.9c714a868e93e7df
CAT-QuickHealTrojan.Scar.20652
ALYacGeneric.Dacic.EA08C894.A.100E1680
CylanceUnsafe
SangforTrojan.Win32.Save.a
K7AntiVirusPassword-Stealer ( 0055e3dc1 )
K7GWPassword-Stealer ( 0055e3dc1 )
Cybereasonmalicious.68e93e
ArcabitGeneric.Dacic.EA08C894.A.100E1680
BitDefenderThetaAI:Packer.6652317B23
VirITTrojan.Win32.Generic.BFGG
CyrenW32/QQPass.AF.gen!Eldorado
Elasticmalicious (moderate confidence)
ESET-NOD32a variant of Win32/PSW.QQPass.OUO
ClamAVWin.Dropper.Tiggre-9845940-0
KasperskyTrojan.Win32.Scar.ihrg
BitDefenderGeneric.Dacic.EA08C894.A.100E1680
NANO-AntivirusTrojan.Win32.Scar.dnnuij
AvastWin32:TrojanX-gen [Trj]
TencentTrojan.Win32.Scar.te
Ad-AwareGeneric.Dacic.EA08C894.A.100E1680
EmsisoftGeneric.Dacic.EA08C894.A.100E1680 (B)
BaiduWin32.Trojan-PSW.QQPass.p
ZillyaTrojan.Scar.Win32.87003
McAfee-GW-EditionBehavesLike.Win32.Generic.mc
Trapminemalicious.high.ml.score
SophosML/PE-A + Troj/Agent-BBAC
SentinelOneStatic AI – Malicious PE
JiangminTrojan/Scar.bdsv
AviraHEUR/AGEN.1237559
MAXmalware (ai score=85)
MicrosoftTrojan:Win32/Wacatac.B!ml
GDataWin32.Trojan-Stealer.BlackMoon.D
CynetMalicious (score: 100)
AhnLab-V3Trojan/Win32.Stealer.R143066
Acronissuspicious
McAfeeGenericRXAA-AA!9C714A868E93
VBA32BScope.Trojan.StartPage
MalwarebytesMalware.AI.217794152
APEXMalicious
RisingTrojan.Kryptik!1.B3E8 (CLASSIC)
IkarusTrojan.Win32.Dynamer
MaxSecureTrojan.Malware.300983.susgen
FortinetW32/GameHack.AX!tr
AVGWin32:TrojanX-gen [Trj]
PandaTrj/Genetic.gen
CrowdStrikewin/malicious_confidence_90% (D)

How to remove Malware.AI.217794152?

Malware.AI.217794152 removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment