Malware

Malware.AI.3984103735 removal guide

Malware Removal

The Malware.AI.3984103735 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Malware.AI.3984103735 virus can do?

  • Behavioural detection: Executable code extraction – unpacking
  • Sample contains Overlay data
  • Yara rule detections observed from a process memory dump/dropped files/CAPE
  • Reads data out of its own binary image
  • CAPE extracted potentially suspicious content
  • Drops a binary and executes it
  • The binary contains an unknown PE section name indicative of packing
  • The binary likely contains encrypted or compressed data.
  • The executable is compressed using UPX
  • Authenticode signature is invalid
  • Behavioural detection: Injection (Process Hollowing)
  • Behavioural detection: Injection (inter-process)

How to determine Malware.AI.3984103735?


File Info:

name: 7E97072CE622E9586D5A.mlw
path: /opt/CAPEv2/storage/binaries/eba4f57e2a8cd0b240414b51345a5f635abf046c97aa50d1e37f4efceff45a9a
crc32: B7DBB0F7
md5: 7e97072ce622e9586d5ae312574b7a6e
sha1: fd095d74090691e523071bdb9c490ddadefd0186
sha256: eba4f57e2a8cd0b240414b51345a5f635abf046c97aa50d1e37f4efceff45a9a
sha512: 5c8de9afe4258380b5c9587cb083fb10d8963217398df008113850a386b8f63307dac2f3f825149d4060e37686e55896fa08d8e8176948750e7907fb7992dbb1
ssdeep: 6144:qUfZ+4vjMrAnYTp4kd03iDxOxTBgjQubBxlCiZNrlUVlhvpfv0nEgaanLeuiqLRA:qK+mjEaYf03ys/hEEgaOLZTdTi
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T16BC4F121FA9A8A07C3F157B3A850927204107C86FBE0BD4A77BCDF6E38A241395D6775
sha3_384: 9d957b8decc52b01670683134c51fd54becf599b32f4d662a23f5028b48f2025432dba4c204fe5257c29a3d4dc582fa2
ep_bytes: 60be00204b008dbe00f0f4ff57eb0b90
timestamp: 2012-01-29 21:32:28

Version Info:

FileDescription:
FileVersion: 3, 3, 8, 1
CompiledScript: AutoIt v3 Script: 3, 3, 8, 1
Translation: 0x0809 0x04b0

Malware.AI.3984103735 also known as:

LionicTrojan.Win32.Daws.b!c
tehtrisGeneric.Malware
MicroWorld-eScanTrojan.Generic.9499338
ClamAVWin.Downloader.LokiBot-7546944-0
FireEyeTrojan.Generic.9499338
ALYacTrojan.Generic.9499338
CylanceUnsafe
VIPRETrojan.Generic.9499338
SangforVirus.Win32.Save.a
K7AntiVirusTrojan ( 700000111 )
AlibabaTrojanDropper:Win32/AuItInj.1172c470
K7GWTrojan ( 700000111 )
CrowdStrikewin/malicious_confidence_100% (W)
VirITTrojan.Win32.Generic.MFP
SymantecTrojan.Gen.MBT
Elasticmalicious (moderate confidence)
ESET-NOD32Win32/VB.OGL
APEXMalicious
Paloaltogeneric.ml
CynetMalicious (score: 100)
KasperskyTrojan-Dropper.Win32.Daws.bqqv
BitDefenderTrojan.Generic.9499338
NANO-AntivirusTrojan.Win32.Daws.brczym
AvastWin32:AutoIt-BYG [Trj]
TencentWin32.Trojan-dropper.Daws.Aljb
Ad-AwareTrojan.Generic.9499338
EmsisoftTrojan.Generic.9499338 (B)
ComodoSuspicious@#71wk6xrinbzw
DrWebTrojan.DownLoader9.45709
ZillyaDropper.Daws.Win32.6604
TrendMicroTROJ_DROPPER.YWK
McAfee-GW-EditionBehavesLike.Win32.Injector.hc
Trapminemalicious.moderate.ml.score
SophosMal/Generic-S + Mal/AuItInj-B
GDataTrojan.Generic.9499338
JiangminTrojanDropper.Daws.dtg
WebrootW32.Malware.Heur.Dkvt
AviraDR/AutoIt.Gen
Antiy-AVLTrojan/Generic.ASBOL.C6D6
KingsoftWin32.Troj.Daws.bq.(kcloud)
MicrosoftTrojan:Win32/Malagent!rfn
GoogleDetected
McAfeeArtemis!7E97072CE622
MAXmalware (ai score=100)
VBA32Trojan.Autoit.Banker
MalwarebytesMalware.AI.3984103735
TrendMicro-HouseCallTROJ_DROPPER.YWK
IkarusTrojan-Spy.Win32.Zbot
MaxSecureTrojan.Autoit.AZA
FortinetW32/Daws.BQQV!tr
AVGWin32:AutoIt-BYG [Trj]
Cybereasonmalicious.ce622e

How to remove Malware.AI.3984103735?

Malware.AI.3984103735 removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment