Malware

Malware.AI.398314526 malicious file

Malware Removal

The Malware.AI.398314526 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Malware.AI.398314526 virus can do?

  • Executable code extraction
  • Injection with CreateRemoteThread in a remote process
  • Attempts to connect to a dead IP:Port (4 unique times)
  • Creates RWX memory
  • Reads data out of its own binary image
  • A process created a hidden window
  • Drops a binary and executes it
  • HTTP traffic contains suspicious features which may be indicative of malware related traffic
  • Performs some HTTP requests
  • The binary likely contains encrypted or compressed data.
  • Uses Windows utilities for basic functionality
  • A system process is generating network traffic likely as a result of process injection
  • Installs itself for autorun at Windows startup
  • Creates a copy of itself
  • Creates a slightly modified copy of itself

Related domains:

z.whorecord.xyz
a.tomx.xyz
www.alliaevo.com
468aircadets.org.uk
4nove.it
adityaintl.com
resolver1.opendns.com
diarop.at
myip.opendns.com
palmgo.at
violov.at
fjroom.su

How to determine Malware.AI.398314526?


File Info:

crc32: 8F483968
md5: 187a765c19ddd94dc72b539009d9b3e6
name: 187A765C19DDD94DC72B539009D9B3E6.mlw
sha1: 862d450c0435b7c66ebc24a63060d94f99c38839
sha256: 17b10be49f04df56329f3f77ae468514ac98803f9f78d6da051b2a724709cc3c
sha512: c132056acac4dd2b7dc59075cbb91f3b19f12f6af3353601ae51ae73b667c097d582aacf793f93d0da894b4264b720bc35d7532b5b51682bdb59a553155e197e
ssdeep: 6144:m5BgmIgIgIgIgIgIgI8I6Ak83AvSSYTBV6dl2WMt8JR2ioQud2M:ggPhhhhhhF6F83IFt2WZJR2ioQZM
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

0: [No Data]

Malware.AI.398314526 also known as:

BkavW32.AIDetect.malware1
Elasticmalicious (high confidence)
DrWebTrojan.PWS.Papras.2836
MicroWorld-eScanGen:Heur.Ransom.Lukitos.1
FireEyeGeneric.mg.187a765c19ddd94d
CAT-QuickHealRansom.Exxroute.A4
McAfeeRansomware-GFC!187A765C19DD
CylanceUnsafe
VIPRETrojan.Win32.Generic!BT
AegisLabTrojan.Win32.Ursnif.l!c
SangforTrojan.Win32.Save.a
K7AntiVirusTrojan ( 0051918c1 )
BitDefenderGen:Heur.Ransom.Lukitos.1
K7GWTrojan ( 0051918c1 )
Cybereasonmalicious.c19ddd
BitDefenderThetaGen:NN.ZexaF.34590.xqW@aagbOpoi
CyrenW32/Ransom.GS.gen!Eldorado
SymantecPacked.Generic.493
TrendMicro-HouseCallRansom_CERBER.SMALY0
AvastWin32:Malware-gen
ClamAVWin.Ransomware.Lukitos-9763593-0
KasperskyHEUR:Trojan.Win32.Generic
NANO-AntivirusTrojan.Win32.Ursnif.esvxua
RisingRansom.Locky!8.1CD4 (CLOUD)
Ad-AwareGen:Heur.Ransom.Lukitos.1
EmsisoftGen:Heur.Ransom.Lukitos.1 (B)
ComodoTrojWare.Win32.Crypt.C@7vajd0
F-SecureHeuristic.HEUR/AGEN.1120891
ZillyaTrojan.Ursnif.Win32.1460
TrendMicroRansom_CERBER.SMALY0
McAfee-GW-EditionBehavesLike.Win32.Worm.fc
SophosML/PE-A + Mal/Elenoocka-E
IkarusTrojan.Win32.Tofsee
JiangminTrojanSpy.Ursnif.agn
eGambitUnsafe.AI_Score_90%
AviraHEUR/AGEN.1120891
Antiy-AVLTrojan[Spy]/Win32.Ursnif
MicrosoftTrojanSpy:Win32/Ursnif.BM!MTB
ArcabitTrojan.Ransom.Lukitos.1
SUPERAntiSpywareRansom.Cerber/Variant
ZoneAlarmHEUR:Trojan.Win32.Generic
GDataWin32.Trojan.Kryptik.IT
CynetMalicious (score: 100)
AhnLab-V3Win-Trojan/Lukitus3.Exp
Acronissuspicious
VBA32Trojan.FakeAV.01657
MAXmalware (ai score=100)
MalwarebytesMalware.AI.398314526
PandaTrj/Genetic.gen
APEXMalicious
ESET-NOD32a variant of Win32/Kryptik.FWNN
TencentMalware.Win32.Gencirc.10bb0b61
YandexTrojan.GenAsa!yInLTl1b6l0
SentinelOneStatic AI – Malicious PE
FortinetW32/Kryptik.FYKK!tr
AVGWin32:Malware-gen
Paloaltogeneric.ml
CrowdStrikewin/malicious_confidence_100% (D)
Qihoo-360Win32/Trojan.Spy.b07

How to remove Malware.AI.398314526?

Malware.AI.398314526 removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment