Malware

Malware.AI.2335535344 removal

Malware Removal

The Malware.AI.2335535344 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Malware.AI.2335535344 virus can do?

  • Injection (inter-process)
  • Injection (Process Hollowing)
  • Executable code extraction
  • Injection with CreateRemoteThread in a remote process
  • Attempts to connect to a dead IP:Port (3 unique times)
  • Enumerates user accounts on the system
  • Creates RWX memory
  • A process attempted to delay the analysis task.
  • At least one IP Address, Domain, or File Name was found in a crypto call
  • Reads data out of its own binary image
  • Creates an excessive number of UDP connection attempts to external IP addresses
  • Performs some HTTP requests
  • Executed a process and injected code into it, probably while unpacking
  • Attempts to modify desktop wallpaper
  • Attempts to repeatedly call a single API many times in order to delay analysis time
  • Exhibits behavior characteristic of Cerber ransomware
  • Attempts to execute a binary from a dead or sinkholed URL
  • Creates a hidden or system file
  • Attempts to access Bitcoin/ALTCoin wallets
  • Collects information to fingerprint the system

Related domains:

z.whorecord.xyz
a.tomx.xyz

How to determine Malware.AI.2335535344?


File Info:

crc32: DEF7D0C1
md5: ba61fab78b8dfd2ce3076a00734213bb
name: BA61FAB78B8DFD2CE3076A00734213BB.mlw
sha1: 0ee874af6185da06c7f763f5692a83570f66dc12
sha256: 1a45906e085007d2eaae18a509fbbbfcf751c011fd6f8563a30b002ae1cb8db8
sha512: 3fb79f63e042f2e7c360fdd07ed6557393f560999d8f64c423c798cc0f4fb832df8c8975193be1a94bd66e7a16eda9297cb346f92134e32753537d2ed4f3aaa5
ssdeep: 6144:3t/bLbGUYYutwyYnndVPlzt6qrF6Tgtqim+KPPJ/KiZ9tLvO/sf7H/PsL:39bLqm9yYnndZlgzEtqNP9tLvO67HXsL
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

0: [No Data]

Malware.AI.2335535344 also known as:

BkavW32.AIDetect.malware1
MicroWorld-eScanGen:Variant.Bulz.22851
FireEyeGeneric.mg.ba61fab78b8dfd2c
CAT-QuickHealRansom.Crysis.A5
ALYacGen:Variant.Bulz.22851
MalwarebytesMalware.AI.2335535344
VIPRETrojan.Win32.Generic!BT
SangforTrojan.Win32.Save.a
CrowdStrikewin/malicious_confidence_100% (W)
BitDefenderGen:Variant.Bulz.22851
K7GWTrojan ( 0050260e1 )
K7AntiVirusTrojan ( 0050260e1 )
BitDefenderThetaGen:NN.ZexaF.34590.yuZ@aiYv41ce
CyrenW32/Trojan2.QITW
SymantecRansom.Cerber!g17
APEXMalicious
AvastWin32:Trojan-gen
ClamAVWin.Dropper.Cerber-9815481-0
KasperskyHEUR:Trojan.Win32.Generic
AlibabaTrojan:Win32/Kryptik.5492836b
NANO-AntivirusTrojan.Win32.Crusis.eklikh
TencentMalware.Win32.Gencirc.10b0f584
Ad-AwareGen:Variant.Bulz.22851
SophosMal/Generic-S + Mal/Cerber-U
F-SecureHeuristic.HEUR/AGEN.1127103
DrWebTrojan.PWS.Siggen1.60995
TrendMicroRansom_HPLOCKY.SM4
McAfee-GW-EditionBehavesLike.Win32.Generic.fc
EmsisoftGen:Variant.Bulz.22851 (B)
SentinelOneStatic AI – Suspicious PE
GDataGen:Variant.Bulz.22851
JiangminTrojanSpy.Zbot.fimx
AviraHEUR/AGEN.1127103
Antiy-AVLTrojan[Spy]/Win32.Zbot
ArcabitTrojan.Bulz.D5943
ZoneAlarmHEUR:Trojan.Win32.Generic
MicrosoftTrojan:Win32/Wacatac.D1!ml
CynetMalicious (score: 100)
AhnLab-V3Trojan/Win32.Cerber.R193644
McAfeeRansomware-FLTU!BA61FAB78B8D
VBA32TrojanSpy.Zbot
PandaTrj/Ransom.BH
ESET-NOD32a variant of Win32/Kryptik.FMWT
TrendMicro-HouseCallRansom_HPLOCKY.SM4
RisingRansom.Cerber!8.3058 (TFE:5:XkRTmivJDeL)
YandexTrojan.Kryptik!8f+TCmrZuMw
MAXmalware (ai score=84)
eGambitUnsafe.AI_Score_99%
FortinetW32/Injector.DMNQ!tr
AVGWin32:Trojan-gen
Qihoo-360Win32/Trojan.Generic.HwoCUV0A

How to remove Malware.AI.2335535344?

Malware.AI.2335535344 removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment