Malware

Malware.AI.3724663882 (file analysis)

Malware Removal

The Malware.AI.3724663882 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Malware.AI.3724663882 virus can do?

  • SetUnhandledExceptionFilter detected (possible anti-debug)
  • Yara rule detections observed from a process memory dump/dropped files/CAPE
  • A process attempted to delay the analysis task.
  • Dynamic (imported) function loading detected
  • Starts servers listening on 127.0.0.1:0
  • Enumerates running processes
  • The binary contains an unknown PE section name indicative of packing
  • Authenticode signature is invalid
  • Uses Windows utilities for basic functionality
  • Uses Windows utilities for basic functionality
  • Uses suspicious command line tools or Windows utilities

Related domains:

wpad.local-net
keyauth.win

How to determine Malware.AI.3724663882?


File Info:

name: B5AF16716A9B84288348.mlw
path: /opt/CAPEv2/storage/binaries/7967f7a2f21b5e7dc33f7d2cafe64e0b320fd21350db03bb5aa19bef8f061ead
crc32: 1A5003DF
md5: b5af16716a9b842883484fd2fb64aadb
sha1: 73570515fd025c1ae80adefd86cff12c26cb6b16
sha256: 7967f7a2f21b5e7dc33f7d2cafe64e0b320fd21350db03bb5aa19bef8f061ead
sha512: d4284af417a676e2b0371fbbf43082965314e263ed2664ac7074f3c357892ffad16b47fea41644494c9f9995cbf5c6f787efafe24e17b0f4df9000da355e9c75
ssdeep: 49152:eGtlquTIU6i8NaQPHHEomhl2PwMH7Agmbf4WTVvztZQSui57mSo2cc0WBwiPaE4i:6+82omhl2DGXplo2zSlE4i
type: PE32+ executable (console) x86-64, for MS Windows
tlsh: T1D9F5AE52A3A800E8D9B7C13CC9564627E7F2B45513B09BDB06B4C67A0F23BE16E3E751
sha3_384: 979ae7cfbb22f5fce14cee555461af4914ebecea44ddaa8602f893f6fecbdf369f32c3db25d6b23a6a9a61df7a045c82
ep_bytes: 4883ec28e8d70700004883c428e972fe
timestamp: 2021-11-22 09:53:26

Version Info:

0: [No Data]

Malware.AI.3724663882 also known as:

LionicTrojan.Win32.Cerbu.4!c
Elasticmalicious (high confidence)
MicroWorld-eScanGen:Variant.Cerbu.93328
FireEyeGen:Variant.Cerbu.93328
ALYacGen:Variant.Cerbu.93328
K7AntiVirusTrojan ( 00578aba1 )
AlibabaTrojan:Win64/Kryptik.0f7ab30b
K7GWTrojan ( 00578aba1 )
Cybereasonmalicious.16a9b8
CyrenW64/Kryptik.EHG.gen!Eldorado
SymantecTrojan.Gen.MBT
ESET-NOD32a variant of Win64/Kryptik.CHJ
TrendMicro-HouseCallTROJ_GEN.R002H0CKM21
Paloaltogeneric.ml
KasperskyUDS:Trojan.Win64.Agentb.a
BitDefenderGen:Variant.Cerbu.93328
AvastWin64:Trojan-gen
Ad-AwareGen:Variant.Cerbu.93328
SophosMal/Generic-S
McAfee-GW-EditionBehavesLike.Win64.CoinMiner.wh
EmsisoftGen:Variant.Cerbu.93328 (B)
SentinelOneStatic AI – Malicious PE
GDataGen:Variant.Cerbu.93328
AviraHEUR/AGEN.1143241
MAXmalware (ai score=84)
GridinsoftRansom.Win64.Gen.sa
MicrosoftTrojan:Script/Phonzy.B!ml
CynetMalicious (score: 100)
AhnLab-V3Trojan/Win.Generic.C4553581
McAfeeArtemis!B5AF16716A9B
MalwarebytesMalware.AI.3724663882
YandexTrojan.Kryptik!htQuwzVRT2U
IkarusTrojan.Win64.Crypt
FortinetW64/Kryptik.CHJ!tr
AVGWin64:Trojan-gen
MaxSecureTrojan.Malware.300983.susgen

How to remove Malware.AI.3724663882?

Malware.AI.3724663882 removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment