About “Malware.AI.3209007636” infection

The Malware.AI.3209007636 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Malware.AI.3209007636 virus can do?

The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
Binary compilation timestomping detected

How to determine Malware.AI.3209007636?


File Info:
name: 3AB0D4697267931EFA3F.mlw
path: /opt/CAPEv2/storage/binaries/a4693a27acba63f0b552b372021e3cecc4c82efdd7c6bccb234ab74999226f42
crc32: B39281B1
md5: 3ab0d4697267931efa3fbd100334b613
sha1: eb5cd0dd7d60ab69331770ea8f6e5942a0b157d6
sha256: a4693a27acba63f0b552b372021e3cecc4c82efdd7c6bccb234ab74999226f42
sha512: 3431fd55a10a9a4db8eb3691e005d93e67f16ddaf9a80caac98a01bceb2e06f932e745e824b703bd2f85476930f2d6951870d684973d9dddd2d3e1c0539797dc
ssdeep: 768:iuj4rW0ddn70q4iLDNjcwtPx157JARuFjlsKf:iddBAi/1XtPx1jARrKf
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T11CD26B50B7F8863BC6BA2BF751B2510007B5AB055925FBDD2EF0309F6EA6B4043117A7
sha3_384: e281805735583b472419f91183a41da682485f22fb87121b5a339d5ea305809581fe1ef1b512d00e9418c4e8f13cd8e8
ep_bytes: ff250020400000000000000000000000
timestamp: 2061-08-11 05:11:20

Version Info:
Translation: 0x0000 0x04b0
Comments: 
CompanyName: 
FileDescription: FakeLogonScreen
FileVersion: 1.0.0.0
InternalName: FakeLogonScreen.exe
LegalCopyright: Copyright ©  2020
LegalTrademarks: 
OriginalFilename: FakeLogonScreen.exe
ProductName: FakeLogonScreen
ProductVersion: 1.0.0.0
Assembly Version: 1.0.0.0

Malware.AI.3209007636 also known as:

MicroWorld-eScan	Gen:Variant.MSILHeracles.11024
CAT-QuickHeal	Trojan.YakbeexMSIL.ZZ4
ALYac	Gen:Variant.MSILHeracles.11024
Cybereason	malicious.972679
Cyren	W32/MSIL_Perseus.AT.gen!Eldorado
Elastic	malicious (high confidence)
ESET-NOD32	a variant of MSIL/PSW.Agent.SNA
Kaspersky	HEUR:Trojan-PSW.MSIL.Agent.gen
BitDefender	Gen:Variant.MSILHeracles.11024
Cynet	Malicious (score: 99)
Avast	PWSX-gen [Trj]
Ad-Aware	Gen:Variant.MSILHeracles.11024
Sophos	ATK/FakeLogon-A
VIPRE	Gen:Variant.MSILHeracles.11024
FireEye	Generic.mg.3ab0d4697267931e
Emsisoft	Gen:Variant.MSILHeracles.11024 (B)
APEX	Malicious
GData	Gen:Variant.MSILHeracles.11024
Avira	HEUR/AGEN.1217876
MAX	malware (ai score=84)
Microsoft	Trojan:Win32/Woreflint.A!cl
Google	Detected
AhnLab-V3	Trojan/Win32.Occamy.C4011827
Malwarebytes	Malware.AI.3209007636
Rising	Trojan.Generic/MSIL@AI.96 (RDM.MSIL:0m0iaEqWGeHCaBYFeTskRw)
Ikarus	Trojan-Ransom.ShellLocker
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	MSIL/Agent.SNA!tr
AVG	PWSX-gen [Trj]
Panda	Trj/GdSda.A
CrowdStrike	win/malicious_confidence_70% (W)

How to remove Malware.AI.3209007636?

Malware.AI.3209007636 removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X