Malware

Should I remove “Malware.AI.2728906779”?

Malware Removal

The Malware.AI.2728906779 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Malware.AI.2728906779 virus can do?

  • SetUnhandledExceptionFilter detected (possible anti-debug)
  • Presents an Authenticode digital signature
  • Dynamic (imported) function loading detected
  • Reads data out of its own binary image
  • Unconventionial language used in binary resources: Russian
  • The binary contains an unknown PE section name indicative of packing
  • Authenticode signature is invalid
  • Created a process from a suspicious location

How to determine Malware.AI.2728906779?


File Info:

name: 0EB949D9535737E2C6A7.mlw
path: /opt/CAPEv2/storage/binaries/fd3f5b7dd635667f5f70ce9279fe55eab91a7259034bf8695bebe7ec82bdc877
crc32: 48B47E7C
md5: 0eb949d9535737e2c6a7a28031749906
sha1: d09235cb53b26fbf41790b282be00905a06333d1
sha256: fd3f5b7dd635667f5f70ce9279fe55eab91a7259034bf8695bebe7ec82bdc877
sha512: a51e14b39826d35ba95a5ca453e363b7e7fa3134e39252618c6eeb9c640d09e6f7cadc5af3b8dd8a6045284941d7121628dd96af93a96e5fdff588b5c27e5318
ssdeep: 6144:PdRVzSkGTxSLD8uq5CaOPs47bhqUdJcdfkCoJFeZwLon8:PhqxSLo5C1Ps4XhHcd8jEn8
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T16E74D003F9C18872D5621A311A39AB51697EB5301F188ADFB3E84D69EF351E17334AB3
sha3_384: 1237ede1a095a2a5d471b7cd212be1c07df3d2ca156a0c811aefa9291e764bc5bfaadb1fb9006d414d975f7bd99476fc
ep_bytes: e884040000e988feffff3b0d68d64300
timestamp: 2020-06-25 10:38:24

Version Info:

0: [No Data]

Malware.AI.2728906779 also known as:

LionicTrojan.Win32.Generic.4!c
Elasticmalicious (high confidence)
MicroWorld-eScanTrojan.GenericKD.38092465
FireEyeTrojan.GenericKD.38092465
ALYacTrojan.GenericKD.38092465
K7AntiVirusTrojan-Downloader ( 0057d5571 )
BitDefenderTrojan.GenericKD.38092465
K7GWTrojan-Downloader ( 0057d5571 )
BitDefenderThetaGen:NN.ZemsilF.34294.im1@a48a3xn
SymantecTrojan.Gen.MBT
ESET-NOD32a variant of MSIL/TrojanDownloader.Agent.HWQ
Paloaltogeneric.ml
AlibabaTrojan:MSIL/DangerousSig.33d66fa1
Ad-AwareTrojan.GenericKD.38092465
SophosMal/Generic-S
McAfee-GW-EditionArtemis!Trojan
EmsisoftTrojan.GenericKD.38092465 (B)
APEXMalicious
AviraTR/Dropper.MSIL.Gen2
MicrosoftTrojan:Win32/Sabsik.FL.B!ml
GDataWin32.Trojan.Agent.94ZLAQ
CynetMalicious (score: 99)
McAfeeRDN/Generic Downloader.x
MAXmalware (ai score=84)
MalwarebytesMalware.AI.2728906779
PandaTrj/Genetic.gen
TencentTrojan.Win32.BitCoinMiner.la
YandexTrojan.DL.Agent!8Wee1gJjlUY
SentinelOneStatic AI – Suspicious SFX
MaxSecureTrojan.Malware.300983.susgen
FortinetMSIL/Agent.HWQ!tr.dldr
AVGWin32:DangerousSig [Trj]
AvastWin32:DangerousSig [Trj]
CrowdStrikewin/malicious_confidence_100% (W)

How to remove Malware.AI.2728906779?

Malware.AI.2728906779 removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment