Malware

Malware.AI.2616691172 malicious file

Malware Removal

The Malware.AI.2616691172 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Malware.AI.2616691172 virus can do?

  • Yara rule detections observed from a process memory dump/dropped files/CAPE
  • Unconventionial language used in binary resources: Chinese (Simplified)
  • The binary contains an unknown PE section name indicative of packing
  • The binary likely contains encrypted or compressed data.
  • The executable is compressed using UPX
  • Authenticode signature is invalid
  • Uses Windows utilities for basic functionality
  • Creates a copy of itself
  • Created a service that was not started

How to determine Malware.AI.2616691172?


File Info:

name: 7F4AA1371EF33610BBCF.mlw
path: /opt/CAPEv2/storage/binaries/c975d721147f40f92c8ad03fa612ec1e9b18d6df8771d91f9dc98297efed3c1c
crc32: 84B4B401
md5: 7f4aa1371ef33610bbcf8ca1fb93bfec
sha1: 0b5d14b49f440aa14ab896ea363a546c352bcdb8
sha256: c975d721147f40f92c8ad03fa612ec1e9b18d6df8771d91f9dc98297efed3c1c
sha512: 99aecd652256b84f61c7826f66014c780b2ea74ceb2d9877ca9ccf990ea2b044f37b28b928d59e563820ca30b8eaa48d08497980618923f4b3c765ec384ea571
ssdeep: 1536:Oxyx8WrLOas4reTD1ZHC86zP1DFbd2P9u+a7OGr8aLx:PWR4aTD1Zi8yDn21ut7foaV
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T15B330201F1D3F9FEE0E965BFD240D593221A74E20C76C46DBD499ED76236A798C2840B
sha3_384: 5199dbf245f0137948252543838f31643817a1a176ad74883dc676ee9699d595c40ef466038034fff06eb91802348b44
ep_bytes: 60be008040008dbe0090ffff57eb0b90
timestamp: 2013-11-02 07:51:09

Version Info:

0: [No Data]

Malware.AI.2616691172 also known as:

BkavW32.AIDetect.malware1
MicroWorld-eScanGen:Variant.Razy.620481
ClamAVWin.Trojan.Agent-1243850
FireEyeGeneric.mg.7f4aa1371ef33610
CAT-QuickHealTrojan.MauvaiseRI.S5244446
ALYacGen:Variant.Razy.620481
CylanceUnsafe
VIPREGen:Variant.Razy.620481
SangforTrojan.Win32.Save.a
K7AntiVirusPassword-Stealer ( 00024cf31 )
BitDefenderGen:Variant.Razy.620481
K7GWPassword-Stealer ( 00024cf31 )
Cybereasonmalicious.71ef33
BitDefenderThetaGen:NN.ZexaF.34646.dmGfaOoY0oj
VirITTrojan.Win32.Agent4.BXWO
CyrenW32/Uosproy.B.gen!Eldorado
SymantecInfostealer.Gampass
Elasticmalicious (moderate confidence)
ESET-NOD32a variant of Win32/PSW.OnLineGames.QQE
BaiduWin32.Trojan-PSW.OLGames.y
CynetMalicious (score: 100)
KasperskyTrojan-PSW.Win32.Agent.akgp
NANO-AntivirusTrojan.Win32.Agent.cqhoek
RisingStealer.OnLineGames!8.131 (TFE:5:Srf6QrIi5CB)
Ad-AwareGen:Variant.Razy.620481
SophosML/PE-A + Mal/Behav-112
ComodoTrojWare.Win32.AntiAV.nhr@4jwxmu
DrWebTrojan.MulDrop5.996
ZillyaTrojan.Agent.Win32.431373
McAfee-GW-EditionBehavesLike.Win32.Generic.qc
Trapminemalicious.high.ml.score
EmsisoftGen:Variant.Razy.620481 (B)
IkarusTrojan.Zlob
JiangminTrojan/Agent.hpeq
WebrootW32.Malware.Gen
AviraTR/Spy.Gen
MAXmalware (ai score=83)
Antiy-AVLTrojan/Generic.ASMalwS.4B
MicrosoftTrojan:Win32/Wacatac.B!ml
ArcabitTrojan.Razy.D977C1
SUPERAntiSpywareTrojan.Agent/Gen-PWS
ZoneAlarmTrojan-PSW.Win32.Agent.akgp
GDataGen:Variant.Razy.620481
GoogleDetected
AhnLab-V3Backdoor/Win32.Graybird.R87469
Acronissuspicious
McAfeeCorrupt-MM!7F4AA1371EF3
VBA32BScope.Trojan.MulDrop
MalwarebytesMalware.AI.2616691172
PandaTrj/Genetic.gen
APEXMalicious
TencentMalware.Win32.Gencirc.10b4d0b8
YandexTrojan.Kazy!hH/GqvTrSEc
SentinelOneStatic AI – Malicious PE
MaxSecureTrojan.Malware.300983.susgen
FortinetW32/Generic.AC.1C901B!tr
AVGWin32:Evo-gen [Trj]
AvastWin32:Evo-gen [Trj]
CrowdStrikewin/malicious_confidence_100% (D)

How to remove Malware.AI.2616691172?

Malware.AI.2616691172 removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment