Malware

About “Malware.AI.2986115137” infection

Malware Removal

The Malware.AI.2986115137 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Malware.AI.2986115137 virus can do?

  • Attempts to connect to a dead IP:Port (2 unique times)
  • Creates RWX memory
  • Reads data out of its own binary image
  • Drops a binary and executes it
  • Performs some HTTP requests
  • Anomalous binary characteristics

Related domains:

crl.verisign.com
ocsp.verisign.com
csc3-2010-crl.verisign.com

How to determine Malware.AI.2986115137?


File Info:

crc32: 67D93DC0
md5: badaf0ccebb579e059c45442426bb82a
name: BADAF0CCEBB579E059C45442426BB82A.mlw
sha1: 1ef2296ba17bcd91bcaf5080f4d848749d0dfd4d
sha256: fb64051c7c4d72040273c9f05b74ea06cda16768319f50f31e3eb56ca277d40d
sha512: c69d26457122c301d5046b114827663571c0160f8f86ae9a00e6099c778db3564531b8738f5f8406d45fae5f45ae9d166adcd889ccce7ddbf23b30b88b61387f
ssdeep: 49152:uIvBH4Fxb4vvREE5DszPLTr+BW4XlCvLiZS:fZYFxb4CzDEW4VoLiZS
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

0: [No Data]

Malware.AI.2986115137 also known as:

Elasticmalicious (high confidence)
DrWebTrojan.DownLoader23.36387
MicroWorld-eScanTrojan.GenericKD.4079584
FireEyeGeneric.mg.badaf0ccebb579e0
CAT-QuickHealTrojan.MSIL
McAfeeArtemis!BADAF0CCEBB5
CylanceUnsafe
VIPRETrojan.Win32.Generic!BT
SangforMalware
K7AntiVirusRiskware ( 0040eff71 )
BitDefenderTrojan.GenericKD.4079584
K7GWRiskware ( 0040eff71 )
Cybereasonmalicious.cebb57
BitDefenderThetaGen:NN.ZemsilCO.34804.am0@aiqp@bf
CyrenW32/MSIL_Kryptik.BEI.gen!Eldorado
SymantecTrojan.Gen.MBT
APEXMalicious
AvastWin32:Malware-gen
KasperskyTrojan.MSIL.Disfa.kncf
AlibabaTrojan:MSIL/Disfa.f72e6bad
NANO-AntivirusTrojan.Win32.Agent.ekfoxl
TencentMsil.Trojan.Disfa.Pjdq
Ad-AwareTrojan.GenericKD.4079584
SophosMal/Generic-S
F-SecureHeuristic.HEUR/AGEN.1110051
TrendMicroTROJ_GEN.R002C0GAP21
McAfee-GW-EditionBehavesLike.Win32.Dropper.tc
EmsisoftTrojan.GenericKD.4079584 (B)
SentinelOneStatic AI – Suspicious PE
AviraHEUR/AGEN.1110051
MAXmalware (ai score=81)
Antiy-AVLTrojan/Win32.Pabin
KingsoftWin32.Troj.Generic_a.a.(kcloud)
MicrosoftTrojan:Win32/Skeeyah.A!rfn
ZoneAlarmTrojan.MSIL.Disfa.kncf
GDataTrojan.GenericKD.4079584
CynetMalicious (score: 100)
ALYacTrojan.GenericKD.4079584
TACHYONTrojan/W32.Pabin.1605542
MalwarebytesMalware.AI.2986115137
PandaTrj/CI.A
ESET-NOD32MSIL/TrojanDownloader.Agent.CUB
TrendMicro-HouseCallTROJ_GEN.R002C0GAP21
YandexTrojan.Pabin!SFZD0+4/tas
IkarusTrojan-Downloader.MSIL.Agent
FortinetMSIL/Agent.CUB!tr.dldr
AVGWin32:Malware-gen
Paloaltogeneric.ml
CrowdStrikewin/malicious_confidence_80% (D)
Qihoo-360Generic/Trojan.354

How to remove Malware.AI.2986115137?

Malware.AI.2986115137 removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment