Malware

Malware.AI.2818992360 removal

Malware Removal

The Malware.AI.2818992360 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Malware.AI.2818992360 virus can do?

  • SetUnhandledExceptionFilter detected (possible anti-debug)
  • Behavioural detection: Executable code extraction – unpacking
  • Yara rule detections observed from a process memory dump/dropped files/CAPE
  • Creates RWX memory
  • Possible date expiration check, exits too soon after checking local time
  • Guard pages use detected – possible anti-debugging.
  • Dynamic (imported) function loading detected
  • Reads data out of its own binary image
  • CAPE extracted potentially suspicious content
  • Drops a binary and executes it
  • Authenticode signature is invalid
  • Uses Windows utilities for basic functionality
  • Created a process from a suspicious location
  • Installs itself for autorun at Windows startup

How to determine Malware.AI.2818992360?


File Info:

name: 1B15246EBA422C272C46.mlw
path: /opt/CAPEv2/storage/binaries/feb0426e4c0d98e8fedc2be59935018fb711a47abb2973f3344a0e4ddb95d598
crc32: 3F568C01
md5: 1b15246eba422c272c4622e4eef21905
sha1: a14275ce8215f7938e4caf0b29051e0c06c87a90
sha256: feb0426e4c0d98e8fedc2be59935018fb711a47abb2973f3344a0e4ddb95d598
sha512: 94317cba766149b1ff3ac36013bba19c196a17b70da8fdab82dc6f2c9882ad10fa17b13bc4a779ab6a9ba02b7401d5fc6f32fd44d3ebebddfc5abf1b8efadbd4
ssdeep: 6144:knx1x2Dfvek42txA8+/nvGFm+ltYkTflDuONxDpHlGcUrjtxxEK:e4O/kx78nvGFm+jP9DusDpHlGcA
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T106641347B282C877E9449370D477BA7AFBB77D0211231A4363583E7A3EE04C7960B695
sha3_384: 55e98725b48fe159c9f637a94fd708143cd6d6c28b457e450cfae400df703ae562715258c8f6197320af1be2e21e528e
ep_bytes: 81ec800100005355565733db68018000
timestamp: 2015-12-27 05:38:55

Version Info:

0: [No Data]

Malware.AI.2818992360 also known as:

LionicTrojan.MSIL.Bladabindi.m!c
Elasticmalicious (high confidence)
DrWebTrojan.DownLoader26.3123
MicroWorld-eScanDropped:Trojan.GenericKD.44483102
FireEyeGeneric.mg.1b15246eba422c27
CAT-QuickHealTrojan.IGENERIC
McAfeeArtemis!1B15246EBA42
CylanceUnsafe
SangforSuspicious.Win32.Save.a
K7AntiVirusUnwanted-Program ( 00568e2f1 )
K7GWUnwanted-Program ( 00568e2f1 )
Cybereasonmalicious.eba422
BitDefenderThetaGen:NN.ZemsilF.34084.xq0@a49tEbo
CyrenW32/Injector.A.gen!Eldorado
SymantecML.Attribute.HighConfidence
ESET-NOD32multiple detections
APEXMalicious
Paloaltogeneric.ml
CynetMalicious (score: 99)
KasperskyUDS:Backdoor.MSIL.Generic
BitDefenderDropped:Trojan.GenericKD.44483102
NANO-AntivirusTrojan.Win32.Bladabindi.ewfvwn
AvastWin32:Malware-gen
TencentMsil.Backdoor.Generic.Dxmz
Ad-AwareDropped:Trojan.GenericKD.44483102
EmsisoftDropped:Trojan.GenericKD.44483102 (B)
ComodoMalware@#33vcnwviyk9bx
TrendMicroTROJ_GEN.R002C0ODN21
SophosMal/Generic-S (PUA)
SentinelOneStatic AI – Suspicious PE
GDataDropped:Trojan.GenericKD.44483102
JiangminBackdoor.MSIL.bnjy
eGambitUnsafe.AI_Score_100%
AviraHEUR/AGEN.1112142
MAXmalware (ai score=98)
Antiy-AVLTrojan/Win32.TSGeneric
ArcabitTrojan.Generic.D2A6C21E
MicrosoftBackdoor:MSIL/Bladabindi
VBA32BScope.Trojan.Occamy
ALYacDropped:Trojan.GenericKD.44483102
MalwarebytesMalware.AI.2818992360
TrendMicro-HouseCallTROJ_GEN.R002C0ODN21
RisingTrojan.Generic@ML.99 (RDML:wFwq74zOuHzM3Y92HTmx0w)
YandexRiskware.Agent!f0fcL61EDjI
IkarusTrojan-Dropper.Agent
FortinetW32/GameHack.QW!tr
AVGWin32:Malware-gen
PandaTrj/CI.A
CrowdStrikewin/malicious_confidence_60% (D)

How to remove Malware.AI.2818992360?

Malware.AI.2818992360 removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment