Categories: Malware

Malware.AI.3721961547 removal guide

The Malware.AI.3721961547 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Malware.AI.3721961547 virus can do?

SetUnhandledExceptionFilter detected (possible anti-debug)
Behavioural detection: Executable code extraction – unpacking
Creates RWX memory
Anomalous file deletion behavior detected (10+)
Dynamic (imported) function loading detected
Manipulates data from or to the Recycle Bin
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
Attempts to modify desktop wallpaper
Installs itself for autorun at Windows startup

How to determine Malware.AI.3721961547?


File Info:
name: 6CB710E9D70CA096C4E7.mlwpath: /opt/CAPEv2/storage/binaries/0e4fd8c9f9879821cfcdf6fe545c717e8174e3545c9581f701f615a6534ef168crc32: 4E0E95A9md5: 6cb710e9d70ca096c4e759cf12493d38sha1: fe41a80967977900a7bce0ccbbbb4e3f0819b1eesha256: 0e4fd8c9f9879821cfcdf6fe545c717e8174e3545c9581f701f615a6534ef168sha512: bfb780800ffcc3a5c131a1658d0c278e42def9a9778bd6324f9c35e9cd8659023120577b1c0fd37fa7c335faf607f0294ef7734d4f13714d78b10091e4e7c32essdeep: 24576:9dyzxD2VfblbvdZsaVu0oER3huhrluyW5bFVXtH53VONJ8rV:93cWx0rl81FJtZIEBtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T111459D00EA01E03DE8B735F40A6E527DB17CAEE41720A5CF53C43BEA9A395F46D3165Asha3_384: 075caed128b419065d9a2effb477e920ce63566090d40cf3307740f4d189805bdca370efe4fe49d6fd73cc1180d151e9ep_bytes: 8bff558bece8d6170100e8110000005dtimestamp: 2018-05-02 16:48:32
Version Info:
FileDescription: Nests Basses Aopen PerformanceLegalTrademarks: Twitter Inc. Copyright 2015Languages: EnglishFileVersion: 6.9.6.4CompanyName: Twitter Inc.InternalName: PimpLegalCopyright: Twitter Inc. Copyright 2015ProductName: PimpPrivateBuild: 6.9.6.4Comments: Nests Basses Aopen PerformanceProductVersion: 6.9.6.4Translation: 0x0409 0x04b0

Malware.AI.3721961547 also known as:

Lionic	Trojan.Win32.Foreign.4!c
Elastic	malicious (high confidence)
FireEye	Generic.mg.6cb710e9d70ca096
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 0052ffb81 )
Alibaba	Ransom:Win32/Foreign.d47d29a9
K7GW	Trojan ( 0052ffb81 )
Cybereason	malicious.967977
BitDefenderTheta	Gen:NN.ZexaE.34212.hr0@a0QkGVli
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Kryptik.GKVO
APEX	Malicious
Avast	Win32:Malware-gen
Cynet	Malicious (score: 100)
Kaspersky	Trojan-Ransom.Win32.Foreign.nzvp
NANO-Antivirus	Trojan.Win32.Kryptik.fbdwai
Tencent	Win32.Trojan.Foreign.Wskl
Sophos	Mal/Generic-S
Comodo	Malware@#1mp8h6pya6gv6
VIPRE	Trojan.Win32.Generic!BT
McAfee-GW-Edition	BehavesLike.Win32.Dropper.tc
Paloalto	generic.ml
GData	Win32.Trojan.Agent.4KLNVM
Jiangmin	Trojan.Foreign.fbz
Avira	HEUR/AGEN.1242900
Gridinsoft	Ransom.Win32.Occamy.sa
Microsoft	Trojan:Win32/Occamy.C0E
TACHYON	Ransom/W32.Foreign.1168384
Acronis	suspicious
McAfee	Artemis!6CB710E9D70C
MAX	malware (ai score=98)
Malwarebytes	Malware.AI.3721961547
TrendMicro-HouseCall	TROJ_GEN.R002H0CB522
Rising	Ransom.Foreign!8.292 (CLOUD)
Yandex	Trojan.Foreign!DQo7hWUDAko
SentinelOne	Static AI – Suspicious PE
Fortinet	W32/GenKryptik.BYTM!tr
AVG	Win32:Malware-gen
Panda	Trj/CI.A
CrowdStrike	win/malicious_confidence_100% (W)