Malware

Should I remove “Malware.AI.3754816852”?

Malware Removal

The Malware.AI.3754816852 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Malware.AI.3754816852 virus can do?

  • Behavioural detection: Executable code extraction – unpacking
  • Creates RWX memory
  • Dynamic (imported) function loading detected
  • Reads data out of its own binary image
  • CAPE extracted potentially suspicious content
  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid
  • Behavioural detection: Injection (Process Hollowing)
  • Executed a process and injected code into it, probably while unpacking
  • Behavioural detection: Injection (inter-process)
  • Created a process from a suspicious location
  • Anomalous binary characteristics

How to determine Malware.AI.3754816852?


File Info:

name: 59B20DD8088278F0C4A0.mlw
path: /opt/CAPEv2/storage/binaries/5bb93811f93d368a555c2b3a47ee56905199f6024e9298777093e1b2a7be8615
crc32: 546F7FA5
md5: 59b20dd8088278f0c4a0d01a3532be5c
sha1: b570598c6092e8cd8246420e617facf94af1e312
sha256: 5bb93811f93d368a555c2b3a47ee56905199f6024e9298777093e1b2a7be8615
sha512: 60c2c4a1b2459a77318b4ae10451d3267091cf8d11980e21241ed6b943b643beba903a5ecc7b35349bce4c6c5fb301e026f3ddd4996686c9afba30622d709233
ssdeep: 24576:zieuxvobMDrIxeMD51dlIDAMnz4HgQf6EieuxvobMDrIxeMD51dlIDAMnz4HgXfq:ruxtrUadJQfvuxtrUadJvq
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1A8B5BF13DD089A93D46C43FCBD574EDC3E166F0CD9A26EEF10123E9B39B22520D8A55A
sha3_384: 516687e45a068b1d80766cd296640df3a7980e78e743f7ef731b1663ad5f9dc1108b3cc6edf232881df0c4f1b78c2d8b
ep_bytes: 68309f4c00e8eeffffff000000000000
timestamp: 2014-08-31 18:54:11

Version Info:

Translation: 0x0409 0x04b0
Comments: VS Revo Group
CompanyName: VS Revo Group
FileDescription: VS Revo Group
LegalCopyright: VS Revo Group
LegalTrademarks: VS Revo Group
ProductName: VS Revo Group
FileVersion: 1.00
ProductVersion: 1.00
InternalName: HmHX
OriginalFilename: HmHX.exe

Malware.AI.3754816852 also known as:

BkavW32.AIDetect.malware2
Elasticmalicious (high confidence)
MicroWorld-eScanGen:Variant.Bulz.241924
FireEyeGeneric.mg.59b20dd8088278f0
ALYacGen:Variant.Bulz.241924
CylanceUnsafe
ZillyaTrojan.Generic.Win32.1276773
SangforTrojan.Win32.Generic.ky
K7AntiVirusTrojan ( 0055e3991 )
AlibabaTrojan:Win32/Injector.b2f66f7a
K7GWTrojan ( 0055e3991 )
Cybereasonmalicious.808827
BitDefenderThetaGen:NN.ZevbaF.34182.lo3@aeTjG!ki
SymantecML.Attribute.HighConfidence
ESET-NOD32a variant of Win32/Injector.AZZV
TrendMicro-HouseCallTROJ_GEN.R002C0RB622
Paloaltogeneric.ml
ClamAVWin.Trojan.Zusy-9836944-0
KasperskyHEUR:Trojan.Win32.Generic
BitDefenderGen:Variant.Bulz.241924
NANO-AntivirusTrojan.Win32.Johnnie.imudma
AvastWin32:GenMalicious-OI [Trj]
TencentWin32.Trojan.Generic.Syic
SophosMal/Generic-R + Mal/VBInj-BC
VIPRETrojan.Win32.Generic!BT
TrendMicroTROJ_GEN.R002C0RB622
McAfee-GW-EditionBehavesLike.Win32.Generic.vc
EmsisoftGen:Variant.Bulz.241924 (B)
IkarusTrojan.Win32.Injector
JiangminTrojan/PSW.Magania.we
AviraHEUR/AGEN.1238975
MAXmalware (ai score=87)
Antiy-AVLTrojan/Generic.ASMalwS.310AC99
GridinsoftRansom.Win32.Wacatac.sa
MicrosoftTrojan:Win32/Ymacco.AA5B
GDataGen:Variant.Bulz.241924
CynetMalicious (score: 99)
McAfeeArtemis!59B20DD80882
MalwarebytesMalware.AI.3754816852
APEXMalicious
RisingTrojan.Injector!8.C4 (CLOUD)
SentinelOneStatic AI – Malicious PE
eGambitUnsafe.AI_Score_84%
FortinetW32/Injector.BLMO!tr
AVGWin32:GenMalicious-OI [Trj]
PandaTrj/CI.A
CrowdStrikewin/malicious_confidence_100% (D)
MaxSecureTrojan.Malware.300983.susgen

How to remove Malware.AI.3754816852?

Malware.AI.3754816852 removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment