Malware

Malware.AI.3694435844 malicious file

Malware Removal

The Malware.AI.3694435844 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Malware.AI.3694435844 virus can do?

  • Executable code extraction
  • Injection with CreateRemoteThread in a remote process
  • Creates RWX memory
  • Attempts to connect to a dead IP:Port (5 unique times)
  • Starts servers listening on 127.0.0.1:0
  • A process created a hidden window
  • HTTP traffic contains suspicious features which may be indicative of malware related traffic
  • Performs some HTTP requests
  • The binary likely contains encrypted or compressed data.
  • Uses Windows utilities for basic functionality
  • Deletes its original binary from disk
  • A system process is generating network traffic likely as a result of process injection
  • Installs itself for autorun at Windows startup
  • Creates a copy of itself
  • Creates a slightly modified copy of itself
  • Anomalous binary characteristics

Related domains:

z.whorecord.xyz
a.tomx.xyz
testniche.com
resolver1.opendns.com
myip.opendns.com
worldwidelighting.net
f11.karilor.at
www.worldwidelighting.net
hce-pa.com
abn.zitti.at
centerlessblade.com
chuckyockey.com
msfiscallyfit.com

How to determine Malware.AI.3694435844?


File Info:

crc32: 1C0F878C
md5: 1e9989dd981e76865419f6ce468ef09e
name: 1E9989DD981E76865419F6CE468EF09E.mlw
sha1: 1901ed8e422b00ffd87ea78cee6d756ab058b458
sha256: 6b6223f8c031481e358d5f9715a4b433c89e5dd9ab6a7f9d03729a3cd8297373
sha512: 8e331c90794ac00f8e07760e21832efed9c94b7289bcd00f3d4e1b5a6c8dcb27e9b783c815670c3ea44c7a3fa9f227e4f83f41463544bcc026ae2b221a4d02d8
ssdeep: 6144:MLGn54i+QRK0/K08kV3qepwgIZLt5EPavsdqwq1P05uC4AubZI:Myn549QRK0TL3qaWLti2sdW1KuGuN
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

0: [No Data]

Malware.AI.3694435844 also known as:

BkavW32.AIDetect.malware1
K7AntiVirusTrojan ( 0053305e1 )
Elasticmalicious (high confidence)
DrWebTrojan.Starter.7551
CynetMalicious (score: 100)
CAT-QuickHealTrojan.Chapak.ZZ6
ALYacTrojan.BRMon.Gen.4
CylanceUnsafe
ZillyaDownloader.Upatre.Win32.65705
SangforTrojan.Win32.Save.a
CrowdStrikewin/malicious_confidence_100% (D)
K7GWTrojan ( 0053305e1 )
Cybereasonmalicious.d981e7
CyrenW32/S-01ba2890!Eldorado
SymantecML.Attribute.HighConfidence
ESET-NOD32a variant of Win32/Kryptik.GEVC
APEXMalicious
AvastWin32:Malware-gen
KasperskyHEUR:Trojan.Win32.Generic
BitDefenderTrojan.BRMon.Gen.4
NANO-AntivirusTrojan.Win32.Upatre.ezdmbc
MicroWorld-eScanTrojan.BRMon.Gen.4
TencentWin32.Trojan.Generic.Ebrl
Ad-AwareTrojan.BRMon.Gen.4
SophosMal/Generic-S + Mal/GandCrab-D
ComodoTrojWare.Win32.NeutrinoPOS.NS@7ku27j
BitDefenderThetaGen:NN.ZexaF.34686.zuW@auzrzdi
VIPRETrojan.Win32.Generic!BT
TrendMicroRansom_GANDCRAB.SMALY-3
McAfee-GW-EditionBehavesLike.Win32.Generic.gc
FireEyeGeneric.mg.1e9989dd981e7686
EmsisoftTrojan.BRMon.Gen.4 (B)
SentinelOneStatic AI – Malicious PE
JiangminTrojan.Banker.NeutrinoPOS.df
AviraTR/Crypt.XPACK.Gen7
eGambitUnsafe.AI_Score_99%
MicrosoftTrojanSpy:Win32/Ursnif
AegisLabTrojan.Win32.Ursnif.l!c
ZoneAlarmHEUR:Trojan.Win32.Generic
GDataTrojan.BRMon.Gen.4
AhnLab-V3Trojan/Win32.RansomCrypt.R223732
Acronissuspicious
McAfeeGenericRXEL-AO!1E9989DD981E
MAXmalware (ai score=99)
VBA32TrojanDownloader.Upatre
MalwarebytesMalware.AI.3694435844
PandaTrj/CI.A
TrendMicro-HouseCallRansom_GANDCRAB.SMALY-3
RisingSpyware.Ursnif!8.1DEF (CLOUD)
YandexTrojan.GenAsa!By0Yg78h0+A
IkarusTrojan.Win32.Krypt
FortinetW32/Kryptik.GVHF!tr
AVGWin32:Malware-gen
Paloaltogeneric.ml

How to remove Malware.AI.3694435844?

Malware.AI.3694435844 removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment