About “Malware.AI.2347968949” infection

The Malware.AI.2347968949 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Malware.AI.2347968949 virus can do?

Dynamic (imported) function loading detected
CAPE extracted potentially suspicious content
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
Binary compilation timestomping detected

How to determine Malware.AI.2347968949?


File Info:
name: D158024B4EB59A40FDC8.mlw
path: /opt/CAPEv2/storage/binaries/ab37f61b9119f9a0a6c4a4ce4656da4466d7d4c1a507952e392da0a21a60863d
crc32: D648CA02
md5: d158024b4eb59a40fdc85b904e3a0a0d
sha1: 2cd91719ef32eac6f887907cfd9b356c76c1670f
sha256: ab37f61b9119f9a0a6c4a4ce4656da4466d7d4c1a507952e392da0a21a60863d
sha512: a934ad3c1aa3607bbe36dc710cfdfaee380553a49bcea43bfcfded502a57ab35a94f47894e5f11caadbf02fb5f20eda49d0b3ec30434a2570f19a8c4c2dab631
ssdeep: 768:RL4TCvl3rJpDGdUQ9HwPTtlDLR4dzS1oBtYcFwVc6K:1vhPDGd4J74NKoxwVcl
type: PE32 executable (console) Intel 80386, for MS Windows
tlsh: T122034AC8B980D156D1BB823A88FE4210A731762B5703856DB48F3695BF513CD57C3EBA
sha3_384: 0b56616e6419c9d68955b65ad392cc8d2f2e7ae20e33738d54fc01bf6269b72825c762c3f2b28d371e863d74dc940740
ep_bytes: ff250020400000000000000000000000
timestamp: 2088-03-15 03:03:04

Version Info:
Translation: 0x0000 0x04b0
Comments: 
CompanyName: 
FileDescription: NoFile
FileVersion: 1.0.0.0
InternalName: NoFile.exe
LegalCopyright: Copyright ©  2022
LegalTrademarks: 
OriginalFilename: NoFile.exe
ProductName: NoFile
ProductVersion: 1.0.0.0
Assembly Version: 1.0.0.0

Malware.AI.2347968949 also known as:

Lionic	Trojan.Win32.Ursu.4!c
MicroWorld-eScan	Gen:Variant.Ursu.241768
FireEye	Generic.mg.d158024b4eb59a40
McAfee	RDN/Generic.dx
Sangfor	Trojan.Win32.Sabsik.FL
Cybereason	malicious.b4eb59
ESET-NOD32	a variant of MSIL/Filecoder.AFI
TrendMicro-HouseCall	TROJ_GEN.R002H09B622
BitDefender	Gen:Variant.Ursu.241768
APEX	Malicious
Ad-Aware	Gen:Variant.Ursu.241768
Emsisoft	Gen:Variant.Ursu.241768 (B)
McAfee-GW-Edition	RDN/Generic.dx
GData	Gen:Variant.Ursu.241768
Webroot	W32.Malware.Gen
MAX	malware (ai score=84)
Arcabit	Trojan.Ursu.D3B068
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
Cynet	Malicious (score: 100)
ALYac	Gen:Variant.Ursu.241768
Malwarebytes	Malware.AI.2347968949
Avast	Win32:Malware-gen
Rising	Trojan.Generic/MSIL@AI.97 (RDM.MSIL:DFHepun5Fn4qpukU/tHt0A)
SentinelOne	Static AI – Suspicious PE
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	MSIL/Filecoder.AFI!tr
AVG	Win32:Malware-gen

How to remove Malware.AI.2347968949?

Malware.AI.2347968949 removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X