Malware

Malware.AI.3976223539 removal instruction

Malware Removal

The Malware.AI.3976223539 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Malware.AI.3976223539 virus can do?

  • Yara rule detections observed from a process memory dump/dropped files/CAPE
  • Performs HTTP requests potentially not found in PCAP.
  • Unconventionial binary language: Chinese (Simplified)
  • Unconventionial language used in binary resources: Chinese (Simplified)
  • The binary contains an unknown PE section name indicative of packing
  • Authenticode signature is invalid
  • Attempts to modify proxy settings
  • Harvests cookies for information gathering

How to determine Malware.AI.3976223539?


File Info:

name: 07D70BAD30C3F1A79B09.mlw
path: /opt/CAPEv2/storage/binaries/60f32c507dacb7a094a5c3cb039bb51edf0b0b7e24956cfdcaf161663e0523b5
crc32: FF2448A6
md5: 07d70bad30c3f1a79b09b3af5466b4cb
sha1: 524c7311ec7543f8c88539032cea455ec912d64b
sha256: 60f32c507dacb7a094a5c3cb039bb51edf0b0b7e24956cfdcaf161663e0523b5
sha512: 630b48921494de1840d0c2ad1215e0814834337b92cf4e9068d0f7d4db7d41e93999d5ae544ee51e3f29da98ac13f63d7c5aa0f6b3c89c5eec39e7eeae1208e7
ssdeep: 12288:aS8oD6K2B6TlFoRXz5fD/dP8vKE/oIEft4kv5XEx8n00p:QW2B+Fotp0vd/JuN5Xbn00p
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T163F48D22B7905533D1732A399D1FA3A89D3ABE117D24BA476BE40D0C4F79680393A3D7
sha3_384: d6b8e07e3c4d229d9413ce070ed027c44f0021ebe1e55b8ca9d4cd30859089568f1b7a5ce5d652c387b5ac622d282adb
ep_bytes: 558bec83c4e033c08945e48945e08945
timestamp: 1992-06-19 22:22:17

Version Info:

CompanyName:
FileDescription:
FileVersion:
InternalName:
LegalCopyright:
LegalTrademarks:
OriginalFilename:
ProductName:
ProductVersion:
Comments:
Translation: 0x0804 0x03a8

Malware.AI.3976223539 also known as:

LionicTrojan.Win32.Ursu.4!c
MicroWorld-eScanGen:Variant.Fragtor.111550
FireEyeGeneric.mg.07d70bad30c3f1a7
ALYacGen:Variant.Fragtor.111550
CylanceUnsafe
SangforTrojan.Win32.Agent.Vp1c
AlibabaTrojan:Win32/Symmi.0fe31c36
Cybereasonmalicious.d30c3f
BitDefenderThetaGen:NN.ZelphiF.34592.UG0@aS@szjeb
SymantecSMG.Heur!gen
Elasticmalicious (high confidence)
APEXMalicious
Paloaltogeneric.ml
BitDefenderGen:Variant.Fragtor.111550
AvastWin32:Malware-gen
TencentWin32.Trojan.Startpage.Hpf
Ad-AwareGen:Variant.Fragtor.111550
EmsisoftGen:Variant.Fragtor.111550 (B)
BaiduWin32.Adware.365Cal.a
VIPREGen:Variant.Fragtor.111550
TrendMicroTROJ_GEN.R002C0OG422
McAfee-GW-EditionRDN/Generic.dx
Trapminesuspicious.low.ml.score
SophosMal/Generic-S
GDataGen:Variant.Fragtor.111550
AviraTR/Symmi.otrsf
ArcabitTrojan.Fragtor.D1B3BE
MicrosoftTrojan:Win32/Wacatac.B!ml
CynetMalicious (score: 99)
AhnLab-V3Malware/Win32.Generic.C4221202
McAfeeRDN/Generic.dx
MAXmalware (ai score=88)
VBA32TScope.Trojan.Delf
MalwarebytesMalware.AI.3976223539
TrendMicro-HouseCallTROJ_GEN.R002C0OG422
RisingTrojan.Generic@AI.98 (RDML:7T+x6J06Ug3PnTFP+ULYbQ)
MaxSecureTrojan.Malware.107323512.susgen
FortinetW32/TrojanDldr.SQA!tr
AVGWin32:Malware-gen
CrowdStrikewin/malicious_confidence_70% (W)

How to remove Malware.AI.3976223539?

Malware.AI.3976223539 removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment