Malware.AI.3961558966 malicious file

The Malware.AI.3961558966 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Malware.AI.3961558966 virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Behavioural detection: Executable code extraction – unpacking
• At least one process apparently crashed during execution
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Loads a driver
• Dynamic (imported) function loading detected
• Performs HTTP requests potentially not found in PCAP.
• Enumerates running processes
• Expresses interest in specific running processes
• Attempts to modify Internet Explorer’s start page
• CAPE extracted potentially suspicious content
• Unconventionial language used in binary resources: Chinese (Simplified)
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• The executable is compressed using UPX
• Authenticode signature is invalid
• Queries information on disks, possibly for anti-virtualization
• Attempts to stop active services
• Network activity contains more than one unique useragent.
• Installs itself for autorun at Windows startup
• Attempts to modify proxy settings

How to determine Malware.AI.3961558966?

File Info:
name: C149BAB14BF1311D1671.mlw
path: /opt/CAPEv2/storage/binaries/6c78b211e38578eafc90ab7450a5993ef418d4d99dad84e464ead9da95defe2e
crc32: 165BA609
md5: c149bab14bf1311d1671f88834e6f768
sha1: 6fac467e3a216761b68c025546a1f379fe079e8b
sha256: 6c78b211e38578eafc90ab7450a5993ef418d4d99dad84e464ead9da95defe2e
sha512: 43c16bb775713f48b8787d4b5bf3131305355227c525c245c212373af8889d64a0bbb99ea8c8cfc3c15638bf98521e87c4b128ade3eb8244057e5524a454d750
ssdeep: 49152:6sUGJaK2iwi0F7/1CndypmgOOi6YJVPNwR8KdodmbEAwuk:fVoKGD/WrgO36+wR8KdoMKuk
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T136C533C1BA04C6B9D265607ECDA6E1F0572A7C14C682262332FA7F1B703B4D36A75C9D
sha3_384: f48d9b3acb810caece0da6b713f7afa5d8579af93a9c863c23c616209e7b18523eb410f382ea72e365c20865e179c096
ep_bytes: 60be00c06a008dbe0050d5ff5789e58d
timestamp: 2021-12-13 16:53:48

Version Info:
0: [No Data]

Malware.AI.3961558966 also known as:

How to remove Malware.AI.3961558966?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.