Malware

Malware.AI.2554617541 removal instruction

Malware Removal

The Malware.AI.2554617541 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Malware.AI.2554617541 virus can do?

  • Performs HTTP requests potentially not found in PCAP.
  • CAPE extracted potentially suspicious content
  • Drops a binary and executes it
  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid
  • CAPE detected the RedLine malware family
  • Attempts to modify proxy settings
  • Deletes executed files from disk
  • Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Malware.AI.2554617541?


File Info:

name: F3D52BC6437AC9E7D067.mlw
path: /opt/CAPEv2/storage/binaries/ff1dcac9c5e33c46ec2210afbe0787429227f138447ad8cdcba324460a9ae139
crc32: 4316E815
md5: f3d52bc6437ac9e7d067f2b36b744ed9
sha1: b3e255f730f007816f94f9760954d5e8330bed16
sha256: ff1dcac9c5e33c46ec2210afbe0787429227f138447ad8cdcba324460a9ae139
sha512: 5b8b5730f6d6a0b2969c5efc4dd741da9d5518e0c9d360fafedddc7c8690e638b204846a73f38008d2f019e8c276e1f5545c7370b26e960e813c49f0018023e7
ssdeep: 6144:K1y+bnr+Ip0yN90QEUjgsKM3wcdDJ7wIw6OsPWHRZ+:XMrYy90KgsKuwsk6DPuRw
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1AA44E113ABD94073E8B117B058F603C30B367DA05D7883AB3782A95E1CB3A94A57577B
sha3_384: 202a8e5c85d313b464fc924741eb10e272f84bbe99107bc001927280dddba9f6d715d4e88c0cdb68985de5917cd448af
ep_bytes: e8f0060000e9000000006a5868b87240
timestamp: 2022-05-24 22:49:06

Version Info:

CompanyName: Microsoft Corporation
FileDescription: Win32 Cabinet Self-Extractor
FileVersion: 11.00.17763.1 (WinBuild.160101.0800)
InternalName: Wextract
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFilename: WEXTRACT.EXE .MUI
ProductName: Internet Explorer
ProductVersion: 11.00.17763.1
Translation: 0x0409 0x04b0

Malware.AI.2554617541 also known as:

BkavW32.AIDetectMalware
LionicTrojan.Win32.Stealerc.4!c
MicroWorld-eScanGen:Heur.Crifi.1
FireEyeGen:Heur.Crifi.1
CAT-QuickHealTrojanPWS.Stealerc.S30657853
McAfeeArtemis!F3D52BC6437A
MalwarebytesMalware.AI.2554617541
SangforTrojan.Win32.Save.a
K7AntiVirusTrojan-Downloader ( 0056a18b1 )
AlibabaTrojanSpy:MSIL/Stealer.314d7a75
K7GWTrojan-Downloader ( 0056a18b1 )
Cybereasonmalicious.730f00
VirITTrojan.Win32.GenusT.DPUQ
SymantecML.Attribute.HighConfidence
Elasticmalicious (high confidence)
ESET-NOD32multiple detections
APEXMalicious
ClamAVWin.Packed.Lazy-9958163-0
KasperskyUDS:Trojan-Spy.MSIL.Stealer.gen
BitDefenderGen:Heur.Crifi.1
NANO-AntivirusTrojan.Win32.Stealerc.jyoxox
SUPERAntiSpywareTrojan.Agent/Gen-Downloader
AvastWin32:TrojanX-gen [Trj]
TencentWin32.Trojan-QQPass.QQRob.Cgow
EmsisoftGen:Heur.Crifi.1 (B)
F-SecureTrojan.TR/Dldr.Agent_AGen.btuqq
DrWebTrojan.PWS.Stealer.37347
VIPREGen:Heur.Crifi.1
TrendMicroTrojanSpy.Win32.REDLINE.YXDHTZ
McAfee-GW-EditionBehavesLike.Win32.Generic.dc
SophosTroj/PlugX-EC
SentinelOneStatic AI – Malicious SFX
GDataMSIL.Trojan-Stealer.Redline.G
JiangminTrojan.PSW.Stealerc.bw
GoogleDetected
AviraTR/Dldr.Agent_AGen.btuqq
Antiy-AVLTrojan/Win32.Casdet
ZoneAlarmHEUR:Trojan-PSW.Win32.Stealerc.gen
MicrosoftTrojan:MSIL/RedLine.MC!MTB
CynetMalicious (score: 99)
AhnLab-V3Trojan/Win.RedLine.R599090
Acronissuspicious
ALYacGen:Heur.Crifi.1
MAXmalware (ai score=86)
Cylanceunsafe
PandaTrj/CI.A
RisingStealer.Agent!1.E5F0 (CLASSIC)
IkarusTrojan-Downloader.Win32.Agent
FortinetW32/Agent_AGen.DZ!tr.dldr
AVGWin32:TrojanX-gen [Trj]
DeepInstinctMALICIOUS
CrowdStrikewin/malicious_confidence_100% (W)

How to remove Malware.AI.2554617541?

Malware.AI.2554617541 removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment