Malware

Malware.AI.2278392499 malicious file

Malware Removal

The Malware.AI.2278392499 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Malware.AI.2278392499 virus can do?

  • Sample contains Overlay data
  • Performs HTTP requests potentially not found in PCAP.
  • Reads data out of its own binary image
  • Drops a binary and executes it
  • The binary contains an unknown PE section name indicative of packing
  • Executable file is packed/obfuscated with MPRESS
  • Authenticode signature is invalid
  • Attempts to repeatedly call a single API many times in order to delay analysis time
  • Attempts to modify proxy settings
  • Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Malware.AI.2278392499?


File Info:

name: 37AC1762210AF4442FBD.mlw
path: /opt/CAPEv2/storage/binaries/23899411ffc9f696233b50de2c275eebef61a056441ec6a3a958eed9876d5c13
crc32: C663EDAF
md5: 37ac1762210af4442fbd3ee0f157d44d
sha1: 1b61881d46712d0c87fb6cb372bfeba4206960f8
sha256: 23899411ffc9f696233b50de2c275eebef61a056441ec6a3a958eed9876d5c13
sha512: 2ad93b48fc42f76a8857134d9658d8cdb72c3ff72e413cf5f1745d4c7840327a69af163ae9b076f26a05395d007c15fdecde0f6138bf82525ed17aa8449db645
ssdeep: 768:T9ECL7YPvPfhBLCY5RRHV5GuUt9H+HRCVd:gDGuUYCVd
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1274347786BE55A72F37FDEB586F641C6E974B0223C06D80D409A43840863FA6DDF1A1E
sha3_384: e0ddbaca66d6d404c46ab4fe206d32fdbe135e970c884a7a141d32d814819d778c52f37c6305b6c28a9230fe554d8f14
ep_bytes: 558d6c248881ecd408000053565733db
timestamp: 2014-01-27 12:19:18

Version Info:

0: [No Data]

Malware.AI.2278392499 also known as:

BkavW32.AIDetectNet.01
LionicTrojan.Win32.Zbot.tpUA
tehtrisGeneric.Malware
MicroWorld-eScanTrojan.Ppatre.Gen.1
FireEyeGeneric.mg.37ac1762210af444
CAT-QuickHealDownloader.Upatre.27298
ALYacTrojan.Ppatre.Gen.1
Cylanceunsafe
VIPRETrojan.Ppatre.Gen.1
SangforTrojan.Win32.Save.a
K7AntiVirusTrojan ( 0052964f1 )
AlibabaTrojanDownloader:Win32/Upatre.207bf0dd
K7GWTrojan ( 0052964f1 )
Cybereasonmalicious.2210af
VirITTrojan.Win32.Upatre.BY
CyrenW32/Upatre.NG.gen!Eldorado
SymantecML.Attribute.HighConfidence
Elasticmalicious (high confidence)
ESET-NOD32a variant of Win32/TrojanDownloader.Waski.B
APEXMalicious
Paloaltogeneric.ml
ClamAVWin.Malware.Bavs-6804154-0
KasperskyHEUR:Trojan-Downloader.Win32.Upatre.gen
BitDefenderTrojan.Ppatre.Gen.1
NANO-AntivirusTrojan.Win32.DownLoad3.frlegi
AvastWin32:Upatre-V [Trj]
TencentTrojan.Win32.Delf.wa
TACHYONTrojan-Downloader/W32.Upatre.55500.B
SophosML/PE-A
DrWebTrojan.DownLoad3.33424
ZillyaTrojan.Waski.Win32.3906
TrendMicroTROJ_GEN.R002C0DAU23
McAfee-GW-EditionBehavesLike.Win32.Generic.qz
Trapminemalicious.high.ml.score
EmsisoftTrojan.Ppatre.Gen.1 (B)
SentinelOneStatic AI – Malicious PE
GDataWin32.Trojan-Downloader.Upatre.BJ
JiangminTrojanSpy.Zbot.fois
GoogleDetected
AviraTR/Crypt.XPACK.Gen
Antiy-AVLVirus/Win32.Expiro.imp
XcitiumTrojWare.Win32.TrojanDownloader.Waski.BU@7nmtnf
ArcabitTrojan.Ppatre.Gen.1
ZoneAlarmHEUR:Trojan-Downloader.Win32.Upatre.gen
MicrosoftTrojan:Win32/Zbot.VHO!MTB
CynetMalicious (score: 100)
AhnLab-V3Trojan/Win.Upatre.R476095
Acronissuspicious
McAfeeGenericRXRZ-CQ!37AC1762210A
MAXmalware (ai score=84)
VBA32Trojan.Download
MalwarebytesMalware.AI.2278392499
TrendMicro-HouseCallTROJ_GEN.R002C0DAU23
RisingSpyware.Zbot!8.16B (TFE:3:zHMEcYKLCaB)
YandexTrojan.Delf!x3yOfYLFlis
IkarusTrojan-Downloader.Win32.Waski
MaxSecureTrojan.Upatre.Gen
FortinetW32/Waski.B!tr
BitDefenderThetaGen:NN.ZexaF.36308.dqZ@aeybIUdi
AVGWin32:Upatre-V [Trj]
PandaTrj/Genetic.gen

How to remove Malware.AI.2278392499?

Malware.AI.2278392499 removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment