What is “Malware.AI.2260231715”?

The Malware.AI.2260231715 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Malware.AI.2260231715 virus can do?

• Behavioural detection: Executable code extraction – unpacking
• SetUnhandledExceptionFilter detected (possible anti-debug)
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• NtSetInformationThread: attempt to hide thread from debugger
• A process attempted to delay the analysis task.
• Dynamic (imported) function loading detected
• At least one IP Address, Domain, or File Name was found in a crypto call
• Performs HTTP requests potentially not found in PCAP.
• HTTPS urls from behavior.
• Starts servers listening on 0.0.0.0:33401, :0, 127.0.0.1:10000
• Enumerates the modules from a process (may be used to locate base addresses in process injection)
• Enumerates running processes
• Expresses interest in specific running processes
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• CAPE detected the EnigmaStub malware family
• Detects the presence of Wine emulator via registry key
• Attempts to modify browser security settings
• Anomalous binary characteristics

How to determine Malware.AI.2260231715?

File Info:
name: 7D9F69C885AD8A5575AF.mlw
path: /opt/CAPEv2/storage/binaries/4c8a73caa966a4013e8530725b855f7e76395534806928299b34a8a7033224ec
crc32: A88ECB0F
md5: 7d9f69c885ad8a5575af331848cc49b4
sha1: 1823881fe27e1e4c09555e900584e50495f3b988
sha256: 4c8a73caa966a4013e8530725b855f7e76395534806928299b34a8a7033224ec
sha512: a7c4b7f42fb1778b90017614d33d629839ed78ee90dc5f7071bf2786163917a06d135226d3b7c8f656d838f2946075201181e9cc1b232c5e86ac1e4da2ecbea7
ssdeep: 49152:v4PIPKQM+gYfLmZUYzWHkxCMH9F/DRth8:vEIPKQM+7fLmZUYzWz0hDRty
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1EC85E02D1E1FF511E1AC0837C00549A80241DC49ABB1E7E35B58BE3EE9352D7AB3D9A6
sha3_384: 6f72f5e8be3ee53d148d83d5234695a484391161cc0f9866a9767a8b2ccbd70db94e7e8ec9e3804cfbcfa83ff8910fa5
ep_bytes: 558bec83c4f0b800104000e801000000
timestamp: 2012-03-08 22:37:52

Version Info:
CompanyName: www.sb-innovation.de
FileDescription: µTorrent
FileVersion: 3.1.3.26837
InternalName: uTorrent.exe
OriginalFilename: uTorrent.exe
LegalCopyright: ©2012 BitTorrent, Inc. All Rights Reserved.
ProductName: µTorrent
ProductVersion: 3.1.3.26837
Translation: 0x0409 0x04e4

Malware.AI.2260231715 also known as:

How to remove Malware.AI.2260231715?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.