Malware

Malware.AI.2697596157 (file analysis)

Malware Removal

The Malware.AI.2697596157 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Malware.AI.2697596157 virus can do?

  • Executable code extraction
  • Attempts to connect to a dead IP:Port (3 unique times)
  • Creates RWX memory
  • Possible date expiration check, exits too soon after checking local time
  • At least one IP Address, Domain, or File Name was found in a crypto call
  • Performs some HTTP requests
  • Unconventionial language used in binary resources: Polish
  • The binary likely contains encrypted or compressed data.
  • Checks for the presence of known windows from debuggers and forensic tools
  • Installs itself for autorun at Windows startup
  • Creates a hidden or system file
  • Attempts to identify installed AV products by installation directory
  • Checks the CPU name from registry, possibly for anti-virtualization
  • Detects VirtualBox through the presence of a registry key
  • Attempts to modify proxy settings
  • Attempts to create or modify system certificates
  • Anomalous binary characteristics

Related domains:

z.whorecord.xyz
iplogger.org
a.tomx.xyz
sliderfriday.top

How to determine Malware.AI.2697596157?


File Info:

crc32: 4EF32733
md5: 24eadca90f3ad48ce5ba6a7fbd62a5f6
name: 24EADCA90F3AD48CE5BA6A7FBD62A5F6.mlw
sha1: 4868bfc54b094a5df2cb92a52abaead5dda003fe
sha256: 73a37cdd1ab22c16783ec5f50d4f5ef8d1bb63e13ca3ef4851ec6e6582dc434a
sha512: 6fa35f264ce444fdc9d1fba067b53e00f0c9c9e1af2ca097099173e794f7c59d4131b2a14f4a53c4e1f06e0d5449d3cf66eac46b72991334cdb8ec487605b74c
ssdeep: 12288:jLIvIGQrbOsK3M9yrCINN91Tt6LTSAFsI5oWpRSpyHwprBHFfS/R:WxQrbO3M9yWIt1T4LhFsOoWpMllfSJ
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

Translation: 0x1209 0x04b8

Malware.AI.2697596157 also known as:

BkavW32.AIDetect.malware2
Elasticmalicious (high confidence)
ClamAVWin.Trojan.Zusy-9895656-0
CylanceUnsafe
SangforTrojan.Win32.Save.a
Cybereasonmalicious.7e1e22
ESET-NOD32a variant of Win32/GenKryptik.FKZJ
APEXMalicious
CynetMalicious (score: 100)
BitDefenderThetaGen:NN.ZelphiCO.34170.!GW@amRm3spi
FireEyeGeneric.mg.7274d6c1a7dc0a09
SentinelOneStatic AI – Suspicious PE
MicrosoftTrojan:Win32/DelfInject.VAM!MTB
VBA32BScope.Backdoor.Remcos
MalwarebytesMalware.AI.2697596157
PandaTrj/GdSda.A
IkarusTrojan.Inject
MaxSecureTrojan.Malware.300983.susgen
FortinetW32/Injector.EPYP!tr

How to remove Malware.AI.2697596157?

Malware.AI.2697596157 removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment