What is “Malware.AI.3981897635”?

The Malware.AI.3981897635 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Malware.AI.3981897635 virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Guard pages use detected – possible anti-debugging.
• Dynamic (imported) function loading detected
• A process created a hidden window
• CAPE extracted potentially suspicious content
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Attempts to remove evidence of file being downloaded from the Internet
• Deletes its original binary from disk
• Behavioural detection: Injection (inter-process)
• Created a process from a suspicious location
• Steals private information from local Internet browsers
• Spoofs its process name and/or associated pathname to appear as a legitimate process
• CAPE detected the Loki malware family
• Harvests credentials from local FTP client softwares
• Harvests information related to installed instant messenger clients
• Harvests information related to installed mail clients
• Collects information to fingerprint the system

How to determine Malware.AI.3981897635?

File Info:
name: BB04D0145B6E41F4C0DE.mlw
path: /opt/CAPEv2/storage/binaries/a2d6241c819ff87b099c1a599d6f0b3323b4387853ca10b126f27a88b7eb48a7
crc32: 5ED77ABE
md5: bb04d0145b6e41f4c0def3658c87ebe6
sha1: 5ebf7aa639a1d43f28e0f50f99b646cee77fc1c5
sha256: a2d6241c819ff87b099c1a599d6f0b3323b4387853ca10b126f27a88b7eb48a7
sha512: 49cc25fbf17048acbff5d6e8aebf479578785ed2677c4b2d434dffad52230a95ca98995247c8b509f7b030e2566c660e64635784a97a8f69bf803b6666330aa5
ssdeep: 3072:hRKBfPKOZIRmGTmHHHXASCvDNa9+TA19fElHBjfe8tslmRF5Vt9:rKhiIemGGnQtIDNyBjfDtmmRF5Vt
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T14504F14877E3802ECA9E8737B12354D070BB05CE6791DB2FA2CA8B2C0D5650DE756BB5
sha3_384: e56c8f646042a009f305e6c07c2b522428151b942059b897ad7bcf063896b7b80cbb8d43bbf5b85ea9becac131844824
ep_bytes: ff250020400000000000000000000000
timestamp: 2017-05-12 02:34:16

Version Info:
Translation: 0x0000 0x04b0
Comments: enupozutivuhayirorux
CompanyName: El Paso Corporation
FileDescription: Elecsys® Tacrolimus
FileVersion: 14.10.18.2
InternalName: bran444.exe
LegalCopyright: Copyright © 2018 El Paso Corporation
OriginalFilename: bran444.exe
ProductName: Elecsys® Tacrolimus
ProductVersion: 14.10.18.2
Assembly Version: 0.0.0.0

Malware.AI.3981897635 also known as:

How to remove Malware.AI.3981897635?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.