Malware

Malware.AI.2306002028 removal

Malware Removal

The Malware.AI.2306002028 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Malware.AI.2306002028 virus can do?

  • Behavioural detection: Executable code extraction – unpacking
  • Creates RWX memory
  • Dynamic (imported) function loading detected
  • Enumerates running processes
  • Expresses interest in specific running processes
  • CAPE extracted potentially suspicious content
  • The binary contains an unknown PE section name indicative of packing
  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid
  • Behavioural detection: Injection (Process Hollowing)
  • Executed a process and injected code into it, probably while unpacking
  • Behavioural detection: Injection (inter-process)
  • Created a process from a suspicious location
  • Installs itself for autorun at Windows startup
  • Likely virus infection of existing system binary
  • Creates Zeus (Banking Trojan) mutexes
  • Anomalous binary characteristics

How to determine Malware.AI.2306002028?


File Info:

name: 739DB910BE60631081D8.mlw
path: /opt/CAPEv2/storage/binaries/5b640a33aad1a28263bccf1dd2dec482310a9ea6ed048e901693d7a0914a1af6
crc32: 0C2E3957
md5: 739db910be60631081d8e135417ef98e
sha1: c1e022eb3974efa4326ecf24437a798f926c945e
sha256: 5b640a33aad1a28263bccf1dd2dec482310a9ea6ed048e901693d7a0914a1af6
sha512: da3dd38bb8c4f0cf4dc7673015a00b1396b23cd0d0ee1c05ed1da35c8f2e0b51bf4011a37ba9ab00ba4ccd9651177e9089e83a8d65ecfd6fadbfb88293127799
ssdeep: 49152:RUIZY0a40Q0BOpzrqkNBBYTBEKmvLf/wStmFAJcj:R7ZdD0DBEv5BOBEt3Xlcj
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T19E8533827F520EECFB00587F89415E4C7289A9361CC31C6F6C7A399ECA5BC9760166ED
sha3_384: a9d3aa40c3990b5fbcd4d4c7d8c5f5c78e7f817858ef25041b65eb8586af513b9e533163b70aae95e15332257a3a1672
ep_bytes: 558bec83c4f0535657b8141f4000e8bd
timestamp: 1992-06-19 22:22:17

Version Info:

0: [No Data]

Malware.AI.2306002028 also known as:

BkavW32.AIDetect.malware2
LionicTrojan.Win32.Rbot.leZz
Elasticmalicious (high confidence)
DrWebTrojan.PWS.Panda.93
MicroWorld-eScanTrojan.Spy.ZBot.JO
FireEyeGeneric.mg.739db910be606310
McAfeePWS-Zbot.gen.h
CylanceUnsafe
VIPRETrojan-Dropper.Win32.Wlord.gen (v)
SangforHacktool.Win32.DelfInject.gen
K7AntiVirusTrojan ( 000009c11 )
AlibabaMalware:Win32/km_2e2a7.None
K7GWTrojan ( 000009c11 )
Cybereasonmalicious.0be606
BitDefenderThetaAI:Packer.11A2F4F61E
VirITTrojan.Win32.Generic.AEO
CyrenW32/Trojan.YLLS-7749
SymantecML.Attribute.HighConfidence
ESET-NOD32Win32/Spy.Agent.PZ
TrendMicro-HouseCallMal_Zbot-7
Paloaltogeneric.ml
ClamAVWin.Trojan.Buzus-7070540-0
KasperskyTrojan-Ransom.Win32.BlueScreen.na
BitDefenderTrojan.Spy.ZBot.JO
NANO-AntivirusTrojan.Win32.BlueScreen.bqrfmw
AvastWin32:Delf-LFA [Drp]
TencentWin32.Trojan.Bluescreen.Ahez
SophosML/PE-A + Mal/Dropper-T
ComodoTrojWare.Win32.PSW.LdPinch.~W1@18pm5y
ZillyaBackdoor.CPEX.Win32.25500
TrendMicroMal_Zbot-7
McAfee-GW-EditionBehavesLike.Win32.Backdoor.tc
EmsisoftTrojan.Spy.ZBot.JO (B)
IkarusVirTool.Win32.DelfInject
JiangminTrojan/Buzus.dyv
MaxSecureDropper.Wlord.Gen
AviraDR/Delphi.Gen
MAXmalware (ai score=89)
Antiy-AVLTrojan/Generic.ASMalwS.12D631
MicrosoftVirTool:Win32/DelfInject.gen!AC
ViRobotTrojan.Win32.Buzus.59904.B
GDataTrojan.Spy.ZBot.JO
AhnLab-V3Worm/Win32.IRCBot.R17761
VBA32SScope.TrojanInjector.xf
ALYacTrojan.Spy.ZBot.JO
MalwarebytesMalware.AI.2306002028
APEXMalicious
RisingTrojan.Win32.Delf.ypn (CLOUD)
YandexTrojan.GenAsa!BeHIHDKM2QY
SentinelOneStatic AI – Malicious PE
eGambitUnsafe.AI_Score_99%
FortinetW32/Injector.WXE!tr
AVGWin32:Delf-LFA [Drp]
PandaTrj/Genetic.gen
CrowdStrikewin/malicious_confidence_100% (D)

How to remove Malware.AI.2306002028?

Malware.AI.2306002028 removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment