Malware

How to remove “Malware.AI.2670838656”?

Malware Removal

The Malware.AI.2670838656 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Malware.AI.2670838656 virus can do?

  • Sample contains Overlay data
  • Performs HTTP requests potentially not found in PCAP.
  • Reads data out of its own binary image
  • CAPE extracted potentially suspicious content
  • Drops a binary and executes it
  • The binary contains an unknown PE section name indicative of packing
  • The binary likely contains encrypted or compressed data.
  • The executable is compressed using UPX
  • Authenticode signature is invalid
  • Attempts to repeatedly call a single API many times in order to delay analysis time
  • CAPE detected the embedded win api malware family
  • Attempts to modify proxy settings
  • Yara detections observed in process dumps, payloads or dropped files

How to determine Malware.AI.2670838656?


File Info:

name: 7A6CAE605CC44472189F.mlw
path: /opt/CAPEv2/storage/binaries/34755418905e86cc6acd53f30c57e47462cb79f2976077901ad1c8a05ad9dce2
crc32: E43EE736
md5: 7a6cae605cc44472189f61702af56070
sha1: bc9f96553dab7ba22dcba9e7f8d47b0b421f3b66
sha256: 34755418905e86cc6acd53f30c57e47462cb79f2976077901ad1c8a05ad9dce2
sha512: 94b40f18eeb582679c0882c6542368c731c9f6742e52dd07ef93fe2dae764fbed6a4e77f13b3f6a168b97d82a3a3c47b415e0907e13db4e1706011720b9b8bc9
ssdeep: 384:4klH2/Zd+LH8p8mcHuLtUqqVYEscW+tRMCrLTFib:PW/Zqs6OLtUqqV3sB+LMGLTkb
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1167207396FD64AB7D377C9F285F392D2AC35F02276029E0E94D90B020823F16AD52D5C
sha3_384: 324a46c958d86834c18294ad7d0a2a8bfcb73c4fab048627b35fa92ebb8944d4e02a346edaa80fff54f494c843b50e98
ep_bytes: 60be005040008dbe00c0ffff5783cdff
timestamp: 2014-04-13 10:53:24

Version Info:

0: [No Data]

Malware.AI.2670838656 also known as:

BkavW32.AIDetectMalware
AVGWin32:Evo-gen [Trj]
Elasticmalicious (moderate confidence)
MicroWorld-eScanGen:Variant.Lazy.500754
FireEyeGeneric.mg.7a6cae605cc44472
CAT-QuickHealTrojanspy.Zbot.16979
SkyhighDownloader-FSH!180A67B80829
McAfeeDownloader-FSH!180A67B80829
MalwarebytesMalware.AI.2670838656
SangforSuspicious.Win32.Save.a
K7AntiVirusTrojan-Downloader ( 0048f6391 )
K7GWTrojan-Downloader ( 005b2d531 )
BitDefenderThetaGen:NN.ZexaF.36804.bmHfa0dDojpi
SymantecDownloader.Upatre
ESET-NOD32Win32/TrojanDownloader.Waski.A
CynetMalicious (score: 100)
APEXMalicious
ClamAVWin.Downloader.Upatre-10025540-0
KasperskyHEUR:Trojan-Downloader.Win32.Adload.gen
BitDefenderGen:Variant.Lazy.500754
NANO-AntivirusTrojan.Win32.Yarwi.cxctqu
AvastWin32:Evo-gen [Trj]
TencentTrojan-spy.Win32.Zbot.sipca
EmsisoftGen:Variant.Lazy.500754 (B)
BaiduWin32.Trojan-Downloader.Waski.a
F-SecureTrojan.TR/Crypt.ZPACK.Gen2
DrWebTrojan.DownLoad3.28161
VIPREGen:Variant.Lazy.500754
TrendMicroTROJ_UPATRE.SM37
Trapminemalicious.moderate.ml.score
SophosMal/Zbot-QL
IkarusWin32.Outbreak
JiangminTrojanSpy.Zbot.ehyz
WebrootW32.Malware.Gen
VaristW32/Upatre.RT.gen!Eldorado
AviraTR/Crypt.ZPACK.Gen2
Antiy-AVLTrojan/Win32.Waski.a
Kingsoftmalware.kb.b.989
MicrosoftTrojan:Win32/Phonzy.B!ml
XcitiumTrojWare.Win32.TrojanDownloader.Waski.BAEA@5p2zlv
ArcabitTrojan.Lazy.D7A412
ViRobotTrojan.Win32.Upatre.17808[UPX]
ZoneAlarmHEUR:Trojan-Downloader.Win32.Adload.gen
GDataWin32.Trojan.PSE.1IQH117
GoogleDetected
AhnLab-V3Trojan/Win.Upatre.R640530
Acronissuspicious
VBA32TrojanSpy.Zbot
ALYacGen:Variant.Lazy.500754
Cylanceunsafe
PandaTrj/CI.A
TrendMicro-HouseCallTROJ_UPATRE.SM37
RisingDownloader.Waski!1.A489 (CLASSIC)
YandexTrojan.GenAsa!b304C+GrKVM
MAXmalware (ai score=83)
FortinetW32/Waski.A!tr
DeepInstinctMALICIOUS

How to remove Malware.AI.2670838656?

Malware.AI.2670838656 removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment