Malware

Malware.AI.3278525394 removal tips

Malware Removal

The Malware.AI.3278525394 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Malware.AI.3278525394 virus can do?

  • Unconventionial binary language: Russian
  • Unconventionial language used in binary resources: Russian
  • The binary contains an unknown PE section name indicative of packing
  • The executable is compressed using UPX
  • Authenticode signature is invalid
  • Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Malware.AI.3278525394?


File Info:

name: A5636DF5B79C29984890.mlw
path: /opt/CAPEv2/storage/binaries/ce117537282b3930d2a201e876d2d7359d634267c83fd7e5ddbc9dd86130ce22
crc32: 07311656
md5: a5636df5b79c299848908f6b3ad8acb5
sha1: 81fcad5fc3b810b67ffb03575bac230883472548
sha256: ce117537282b3930d2a201e876d2d7359d634267c83fd7e5ddbc9dd86130ce22
sha512: 28d10a773f342acf9bf3fc1dc07e27e175b57ee396f5f4b17c33a869a68a0efc33b01e1ff6a7c6d9683e2b1ab8d0a5023e90fac51d846c7f9df6339cace3a0c5
ssdeep: 3072:V4TGa8AMRoLKopG+qDPp/uSc9WWeNxJVH2oSBqUegBtOWls:V6wAMRQJQ+qjNcTS2DY
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1B774711793EC4494F8B3A6349BB5417657627C811A3ECD3C10642E2DA8B3E90798AFF7
sha3_384: e141f5ac958bf216892f4926b940029ad97cfe1ef8d979acec4883b495005a250a17154cdfcfc6b5088d345241bec29c
ep_bytes: e8fb150000e978feffff8bff558bec8b
timestamp: 2013-03-04 05:14:18

Version Info:

CompanyName: Корпорация Майкрософт
FileDescription: Программа просмотра папки обмена Windows NT
FileVersion: 5.1.2600.5512 (xpsp.080413-2105)
InternalName: CLIPBRD
LegalCopyright: © Корпорация Майкрософт. Все права защищены.
OriginalFilename: CLIPBRD.EXE
ProductName: Операционная система Microsoft® Windows®
ProductVersion: 5.1.2600.5512
Translation: 0x0419 0x04b0

Malware.AI.3278525394 also known as:

BkavW32.AIDetectMalware
tehtrisGeneric.Malware
DrWebTrojan.Mayachok.18397
MicroWorld-eScanGen:Variant.Ursu.859567
FireEyeGeneric.mg.a5636df5b79c2998
ALYacGen:Variant.Ursu.859567
MalwarebytesMalware.AI.3278525394
ZillyaBackdoor.Cidox.Win32.3098
SangforTrojan.Win32.Save.a
K7AntiVirusTrojan ( 004bcce41 )
AlibabaTrojan:Win32/Packre.f0b13af0
K7GWTrojan ( 004bcce41 )
Cybereasonmalicious.5b79c2
BitDefenderThetaGen:NN.ZexaF.36196.wq0@a0YAQ7ok
CyrenW32/ABRisk.WQRT-0274
SymantecML.Attribute.HighConfidence
Elasticmalicious (moderate confidence)
ESET-NOD32Win32/Citirevo.AE
ZonerTrojan.Win32.14921
APEXMalicious
CynetMalicious (score: 100)
KasperskyHEUR:Trojan.Win32.Packre.gen
BitDefenderGen:Variant.Ursu.859567
NANO-AntivirusTrojan.Win32.Mayachok.cransn
AvastWin32:CryptoWall-C [Trj]
EmsisoftGen:Variant.Ursu.859567 (B)
F-SecureTrojan.TR/Crypt.XPACK.Gen7
VIPREGen:Variant.Ursu.859567
TrendMicroTROJ_GEN.R002C0DEO23
McAfee-GW-EditionBehavesLike.Win32.Generic.fm
Trapminemalicious.high.ml.score
SophosMal/Generic-S
SentinelOneStatic AI – Malicious PE
GDataGen:Variant.Ursu.859567
JiangminBackdoor.Cidox.ao
AviraTR/Crypt.XPACK.Gen7
Antiy-AVLTrojan[Backdoor]/Win32.Cidox
ArcabitTrojan.Ursu.DD1DAF
ZoneAlarmHEUR:Trojan.Win32.Packre.gen
MicrosoftTrojan:Win32/Vundo
GoogleDetected
AhnLab-V3Backdoor/Win.Cidox.R581104
McAfeeVundo-FBIX!A5636DF5B79C
MAXmalware (ai score=84)
VBA32BScope.Trojan.Click
Cylanceunsafe
PandaTrj/Chgt.AD
TrendMicro-HouseCallTROJ_GEN.R002C0DEO23
RisingTrojan.Citirevo!8.537 (CLOUD)
IkarusTrojan.Win32.Citirevo
FortinetW32/Kryptik.AWBJ!tr
AVGWin32:CryptoWall-C [Trj]
DeepInstinctMALICIOUS
CrowdStrikewin/malicious_confidence_90% (W)

How to remove Malware.AI.3278525394?

Malware.AI.3278525394 removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment