Malware

Malware.AI.3672881832 removal tips

Malware Removal

The Malware.AI.3672881832 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Malware.AI.3672881832 virus can do?

  • Yara rule detections observed from a process memory dump/dropped files/CAPE
  • Presents an Authenticode digital signature
  • Anomalous file deletion behavior detected (10+)
  • Dynamic (imported) function loading detected
  • Performs HTTP requests potentially not found in PCAP.
  • HTTPS urls from behavior.
  • Enumerates running processes
  • Reads data out of its own binary image
  • Authenticode signature is invalid
  • Uses Windows utilities for basic functionality
  • Uses Windows utilities for basic functionality
  • Installs itself for autorun at Windows startup
  • Attempts to modify proxy settings
  • Uses suspicious command line tools or Windows utilities

How to determine Malware.AI.3672881832?


File Info:

name: 2E56F3EE50BCCBCB87ED.mlw
path: /opt/CAPEv2/storage/binaries/1d62da5f0bfff8aab33d0d629afada7878a037b46ca591d02bb8f23766d6c9a3
crc32: E04A1388
md5: 2e56f3ee50bccbcb87ed0a31fa6cfe3d
sha1: f9404d6863ade1ef342260dc560eb5365ce26e49
sha256: 1d62da5f0bfff8aab33d0d629afada7878a037b46ca591d02bb8f23766d6c9a3
sha512: f528f88e9839abb19703b8c2da87e31590b89cf0bae49460ccb1adcc38f0ce6586eddcf0aa885c76f800eafbd782ebe58d5cfe1f411b348102f7e5646f6d3743
ssdeep: 6144:KQqKqgeepEcBV0GjwxZzlMJtn9ZWXPtsfiJLjeepEcBV0yfi5:p53D0GUxZzlC9QXPqfin3D0yfi5
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T13944124929E0ECB0CAA6CC320163E66FFF72BF641426012FA7193E7D2DF574B854519A
sha3_384: 7b68714ee207e59f3422d18cebb7ddcc45fc09ecf3c7b611d3dd22711ee5a7aa75995cb400ddf71e7c34001de27c63aa
ep_bytes: 81ec8001000053555633db57895c2418
timestamp: 2009-12-05 22:50:41

Version Info:

0: [No Data]

Malware.AI.3672881832 also known as:

LionicTrojan.Win32.Agent.4!c
MicroWorld-eScanTrojan.GenericKD.48964326
FireEyeTrojan.GenericKD.48964326
CylanceUnsafe
SangforTrojan.Win32.Agent.acbzd
CrowdStrikewin/grayware_confidence_100% (W)
AlibabaTrojan:Win32/PopAd.a33536ce
K7GWAdware ( 00587e8f1 )
K7AntiVirusAdware ( 00587e8f1 )
VirITTrojan.Win32.Siggen5.DKOP
APEXMalicious
Paloaltogeneric.ml
KasperskyTrojan.Win32.Agent.acbzd
BitDefenderTrojan.GenericKD.48964326
TencentWin32.Trojan.Agent.Htco
Ad-AwareTrojan.GenericKD.48964326
EmsisoftTrojan.GenericKD.48964326 (B)
F-SecureHeuristic.HEUR/AGEN.1238143
DrWebTrojan.Siggen5.59867
ZillyaTrojan.GenericCRTD.Win32.4600
TrendMicroTROJ_SPNV.03JR13
McAfee-GW-EditionArtemis!PUP
SophosMal/Generic-S
Ikarusnot-a-virus:AdWare.PopAd
GDataTrojan.GenericKD.48964326
WebrootW32.AGent.acbzd
AviraHEUR/AGEN.1238143
MAXmalware (ai score=80)
Antiy-AVLTrojan/Win32.Wacatac
KingsoftWin32.Troj.Agent.(kcloud)
ArcabitTrojan.Generic.D2EB22E6
ViRobotAdware.Agent.270672
ZoneAlarmTrojan.Win32.Agent.acbzd
MicrosoftTrojan:Win32/Wacatac.B!ml
CynetMalicious (score: 99)
AhnLab-V3PUP/Win32.Helper.C212498
McAfeeArtemis!2E56F3EE50BC
MalwarebytesMalware.AI.3672881832
TrendMicro-HouseCallTROJ_SPNV.03JR13
FortinetW32/Agent.ACBZD!tr

How to remove Malware.AI.3672881832?

Malware.AI.3672881832 removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment