Malware

Malware.AI.2718426877 malicious file

Malware Removal

The Malware.AI.2718426877 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Malware.AI.2718426877 virus can do?

  • Injection with CreateRemoteThread in a remote process
  • Attempts to connect to a dead IP:Port (1 unique times)
  • Possible date expiration check, exits too soon after checking local time
  • A process attempted to delay the analysis task.
  • Expresses interest in specific running processes
  • Repeatedly searches for a not-found process, may want to run with startbrowser=1 option
  • A process created a hidden window
  • Drops a binary and executes it
  • Performs some HTTP requests
  • Unconventionial language used in binary resources: Korean
  • Uses Windows utilities for basic functionality
  • Code injection with CreateRemoteThread in a remote process
  • Deletes its original binary from disk
  • A system process is generating network traffic likely as a result of process injection
  • Creates a hidden or system file
  • Anomalous binary characteristics

Related domains:

www.56561234.com

How to determine Malware.AI.2718426877?


File Info:

crc32: E10BC1AE
md5: 315fd3d76559bebfd469668168a47907
name: 315FD3D76559BEBFD469668168A47907.mlw
sha1: 0e54fb096db7c063c9923e5f60e20637eec7b0f8
sha256: a2b868ceadc19a4f88dfc2edda3956739872fd8ded2a243922d55f3c64125827
sha512: 28ec7a281b31eff7a851e164082c1eb59f1a35f50f1ccf33b8076cbc58913ec014a2f5549c9492140ad07942253d8643490cd3ae749c676f1df11350d8542caf
ssdeep: 192:1dKnulaOoGvciTlLGyoqtaVw2wLbU/qyiJJ9VqlrGs:HKunlAyoqw69LbSqyihSKs
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

LegalCopyright: Copyright (C) 2017
ProductVersion: 1, 0, 0, 1
ProductName: xc751xc6a9 xd504xb85cxadf8xb7a8
FileVersion: 1, 0, 0, 1
FileDescription: xc751xc6a9 xd504xb85cxadf8xb7a8
Translation: 0x0409 0x04b0

Malware.AI.2718426877 also known as:

K7AntiVirusTrojan-Downloader ( 005812bc1 )
LionicTrojan.Win32.Latot.d!c
Elasticmalicious (high confidence)
DrWebTrojan.Siggen15.2839
CynetMalicious (score: 100)
ALYacTrojan.Generic.30220777
CylanceUnsafe
SangforTrojan.Win32.Latot.gen
CrowdStrikewin/malicious_confidence_100% (W)
K7GWTrojan-Downloader ( 005812bc1 )
Cybereasonmalicious.96db7c
CyrenW32/Bloop.A.gen!Eldorado
SymantecML.Attribute.HighConfidence
ESET-NOD32Win32/TrojanDownloader.Agent.FUT
APEXMalicious
AvastWin32:TrojanX-gen [Trj]
KasperskyHEUR:Trojan-GameThief.Win32.Latot.gen
BitDefenderTrojan.Generic.30220777
NANO-AntivirusTrojan.Win32.Latot.jckfhv
ViRobotTrojan.Win32.Z.Small.10752.ON
MicroWorld-eScanTrojan.Generic.30220777
TencentMalware.Win32.Gencirc.10cef0a6
Ad-AwareTrojan.Generic.30220777
BitDefenderThetaGen:NN.ZexaE.34170.aq0@a0aXtIjO
McAfee-GW-EditionBehavesLike.Win32.Dropper.lm
FireEyeGeneric.mg.315fd3d76559bebf
EmsisoftTrojan.Generic.30220777 (B)
SentinelOneStatic AI – Malicious PE
JiangminTrojan.PSW.Latot.ms
AviraHEUR/AGEN.1141417
Antiy-AVLTrojan/Generic.ASMalwS.3468D95
MicrosoftTrojan:Win32/Sabsik.FL.B!ml
GDataTrojan.Generic.30220777
AhnLab-V3Malware/Win.Dlder.R442773
McAfeeGenericRXAA-AA!315FD3D76559
MAXmalware (ai score=82)
VBA32BScope.Trojan.Wacatac
MalwarebytesMalware.AI.2718426877
PandaTrj/GdSda.A
TrendMicro-HouseCallTROJ_GEN.R002C0WIT21
IkarusTrojan-Downloader.Win32.Small
FortinetW32/Small.BHZ!tr
AVGWin32:TrojanX-gen [Trj]
Paloaltogeneric.ml

How to remove Malware.AI.2718426877?

Malware.AI.2718426877 removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment