Categories: Malware

Malware.AI.3278525394 removal tips

The Malware.AI.3278525394 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Malware.AI.3278525394 virus can do?

Unconventionial binary language: Russian
Unconventionial language used in binary resources: Russian
The binary contains an unknown PE section name indicative of packing
The executable is compressed using UPX
Authenticode signature is invalid
Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Malware.AI.3278525394?


File Info:
name: A5636DF5B79C29984890.mlwpath: /opt/CAPEv2/storage/binaries/ce117537282b3930d2a201e876d2d7359d634267c83fd7e5ddbc9dd86130ce22crc32: 07311656md5: a5636df5b79c299848908f6b3ad8acb5sha1: 81fcad5fc3b810b67ffb03575bac230883472548sha256: ce117537282b3930d2a201e876d2d7359d634267c83fd7e5ddbc9dd86130ce22sha512: 28d10a773f342acf9bf3fc1dc07e27e175b57ee396f5f4b17c33a869a68a0efc33b01e1ff6a7c6d9683e2b1ab8d0a5023e90fac51d846c7f9df6339cace3a0c5ssdeep: 3072:V4TGa8AMRoLKopG+qDPp/uSc9WWeNxJVH2oSBqUegBtOWls:V6wAMRQJQ+qjNcTS2DYtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1B774711793EC4494F8B3A6349BB5417657627C811A3ECD3C10642E2DA8B3E90798AFF7sha3_384: e141f5ac958bf216892f4926b940029ad97cfe1ef8d979acec4883b495005a250a17154cdfcfc6b5088d345241bec29cep_bytes: e8fb150000e978feffff8bff558bec8btimestamp: 2013-03-04 05:14:18
Version Info:
CompanyName: Корпорация МайкрософтFileDescription: Программа просмотра папки обмена Windows NTFileVersion: 5.1.2600.5512 (xpsp.080413-2105)InternalName: CLIPBRDLegalCopyright: © Корпорация Майкрософт. Все права защищены.OriginalFilename: CLIPBRD.EXEProductName: Операционная система Microsoft® Windows®ProductVersion: 5.1.2600.5512Translation: 0x0419 0x04b0

Malware.AI.3278525394 also known as:

Bkav	W32.AIDetectMalware
tehtris	Generic.Malware
DrWeb	Trojan.Mayachok.18397
MicroWorld-eScan	Gen:Variant.Ursu.859567
FireEye	Generic.mg.a5636df5b79c2998
ALYac	Gen:Variant.Ursu.859567
Malwarebytes	Malware.AI.3278525394
Zillya	Backdoor.Cidox.Win32.3098
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 004bcce41 )
Alibaba	Trojan:Win32/Packre.f0b13af0
K7GW	Trojan ( 004bcce41 )
Cybereason	malicious.5b79c2
BitDefenderTheta	Gen:NN.ZexaF.36196.wq0@a0YAQ7ok
Cyren	W32/ABRisk.WQRT-0274
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (moderate confidence)
ESET-NOD32	Win32/Citirevo.AE
Zoner	Trojan.Win32.14921
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	HEUR:Trojan.Win32.Packre.gen
BitDefender	Gen:Variant.Ursu.859567
NANO-Antivirus	Trojan.Win32.Mayachok.cransn
Avast	Win32:CryptoWall-C [Trj]
Emsisoft	Gen:Variant.Ursu.859567 (B)
F-Secure	Trojan.TR/Crypt.XPACK.Gen7
VIPRE	Gen:Variant.Ursu.859567
TrendMicro	TROJ_GEN.R002C0DEO23
McAfee-GW-Edition	BehavesLike.Win32.Generic.fm
Trapmine	malicious.high.ml.score
Sophos	Mal/Generic-S
SentinelOne	Static AI – Malicious PE
GData	Gen:Variant.Ursu.859567
Jiangmin	Backdoor.Cidox.ao
Avira	TR/Crypt.XPACK.Gen7
Antiy-AVL	Trojan[Backdoor]/Win32.Cidox
Arcabit	Trojan.Ursu.DD1DAF
ZoneAlarm	HEUR:Trojan.Win32.Packre.gen
Microsoft	Trojan:Win32/Vundo
Google	Detected
AhnLab-V3	Backdoor/Win.Cidox.R581104
McAfee	Vundo-FBIX!A5636DF5B79C
MAX	malware (ai score=84)
VBA32	BScope.Trojan.Click
Cylance	unsafe
Panda	Trj/Chgt.AD
TrendMicro-HouseCall	TROJ_GEN.R002C0DEO23
Rising	Trojan.Citirevo!8.537 (CLOUD)
Ikarus	Trojan.Win32.Citirevo
Fortinet	W32/Kryptik.AWBJ!tr
AVG	Win32:CryptoWall-C [Trj]
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_90% (W)