Malware

Malware.AI.3891515721 removal instruction

Malware Removal

The Malware.AI.3891515721 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Malware.AI.3891515721 virus can do?

  • Yara rule detections observed from a process memory dump/dropped files/CAPE
  • Creates RWX memory
  • Possible date expiration check, exits too soon after checking local time
  • Dynamic (imported) function loading detected
  • Reads data out of its own binary image
  • A process created a hidden window
  • Authenticode signature is invalid
  • Created a process from a suspicious location
  • Anomalous binary characteristics

How to determine Malware.AI.3891515721?


File Info:

name: 2020B4B68FA22F9E8DEA.mlw
path: /opt/CAPEv2/storage/binaries/19c4d866734be59ddf05ee8f562c54c5ea8fb9d4ee4927e19ca8805125eb2428
crc32: D22CC779
md5: 2020b4b68fa22f9e8dea23e0151788e0
sha1: b01db50a8fe235d7ec9f204a5e91db91728e4ceb
sha256: 19c4d866734be59ddf05ee8f562c54c5ea8fb9d4ee4927e19ca8805125eb2428
sha512: 4cb8792b69f46050084be2840b7d018c6f8f249103051162ff2d31d43cbcbd9a521e31695547490d952d0d3756b3d27c7949cf1e4f45189580bc0b6eb89ab4ac
ssdeep: 768:HOQjbFXq3oXFmTggggggLvggggggggSc/:uQjpXF1K/
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T144E2A4B163D105C0EA825D7A9972620DE18D7F1313835ED71F70FA894BF07D3AA32A68
sha3_384: 92b472573cbf7e06771b83a0100de6725e86005edb606719dab6758cf76ed989f49a9c1d8811b0f7f7129cc7d81004a8
ep_bytes: 558bec6aff687031400068c211400064
timestamp: 1994-04-22 02:36:40

Version Info:

CompanyName: Juice
FileDescription: Juice proged
FileVersion: Version 2.1.1
InternalName: Juice
LegalCopyright: Copyright by Sego©
OriginalFilename: iJuice
Translation: 0x0409 0x04e3

Malware.AI.3891515721 also known as:

Elasticmalicious (high confidence)
DrWebTrojan.PWS.Panda.7579
MicroWorld-eScanTrojan.Upatre.Gen.3
FireEyeGeneric.mg.2020b4b68fa22f9e
CAT-QuickHealTrojanDownloader.Upatre.AA4
ALYacTrojan.Upatre.Gen.3
CylanceUnsafe
K7AntiVirusTrojan-Downloader ( 0048f6391 )
Cybereasonmalicious.68fa22
BitDefenderThetaGen:NN.ZexaF.34084.cq1@aKfT6Qai
CyrenW32/Zbot.SA.gen!Eldorado
SymantecSMG.Heur!gen
ESET-NOD32Win32/TrojanDownloader.Waski.A
TrendMicro-HouseCallTROJ_UPATRE.SMRC
ClamAVWin.Packed.Upatre-9848576-0
BitDefenderTrojan.Upatre.Gen.3
NANO-AntivirusTrojan.Win32.Panda.ddqndf
AvastWin32:Trojan-gen
Ad-AwareTrojan.Upatre.Gen.3
EmsisoftTrojan.Upatre.Gen.3 (B)
ComodoTrojWare.Win32.TrojanDownloader.Upatre.AKJ@5e815w
BaiduWin32.Trojan-Downloader.Waski.a
VIPRETrojan.Win32.Upatre.aa (v)
TrendMicroTROJ_UPATRE.SMRC
McAfee-GW-EditionBehavesLike.Win32.Downloader.nz
SophosML/PE-A + Mal/Zbot-QL
SentinelOneStatic AI – Malicious PE
GDataTrojan.Upatre.Gen.3
JiangminTrojan/Cryptodef.au
AviraTR/Crypt.ZPACK.Gen2
MAXmalware (ai score=87)
Antiy-AVLTrojan/Generic.ASMalwS.B541F6
ArcabitTrojan.Upatre.Gen.3
MicrosoftTrojan:Win32/Zbot.svfs!MTB
CynetMalicious (score: 99)
AhnLab-V3Spyware/Win32.Zbot.R115088
Acronissuspicious
McAfeeDownloader-FSH
VBA32BScope.TrojanDownloader.Hyteod
MalwarebytesMalware.AI.3891515721
APEXMalicious
RisingTrojan.DL.Win32.Upatre.aab (CLASSIC)
IkarusTrojan.Win32.Bublik
FortinetW32/Waski.A!tr.dldr
AVGWin32:Trojan-gen
PandaTrj/Genetic.gen
CrowdStrikewin/malicious_confidence_100% (D)

How to remove Malware.AI.3891515721?

Malware.AI.3891515721 removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment