Malware

Malware.AI.4073761772 information

Malware Removal

The Malware.AI.4073761772 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Malware.AI.4073761772 virus can do?

  • Behavioural detection: Executable code extraction – unpacking
  • SetUnhandledExceptionFilter detected (possible anti-debug)
  • Dynamic (imported) function loading detected
  • Yara rule detections observed from a process memory dump/dropped files/CAPE
  • Creates RWX memory
  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid

How to determine Malware.AI.4073761772?


File Info:

name: 951CE700AB6D29032AAC.mlw
path: /opt/CAPEv2/storage/binaries/a19c1c86761fbed1eb101f9da68a3dbcf86c4e18da22d18c855ee2f1075d9fd2
crc32: F0294FF9
md5: 951ce700ab6d29032aac457b1427b62e
sha1: 44ee1c2340f93784f84c1b3fc1a46d35df140646
sha256: a19c1c86761fbed1eb101f9da68a3dbcf86c4e18da22d18c855ee2f1075d9fd2
sha512: a2f9e1e9a203086407ffdd0fa0e4c766a776511bc694d43c8d3fc04b718d03b4d5898ef33fe9c3125d310f1341b5d1463eb2fa2282a9c346b2e9066938943296
ssdeep: 49152:Q8vTRk+SH7RGAoF/swno6O6en4gpftPLYCdDKmj4nrqgWU8SyqNiDyyeG:Q8vm+SdG3ZTno6O6E4gVxYCAmZeG
type: PE32 executable (console) Intel 80386, for MS Windows
tlsh: T175E5BF22F74144B9EBE21274E2FA637A9939BE504368C4D747C23EA54931AD36B3D3C4
sha3_384: c3deb2c45c6fe6638c13f7a8345fe2ae9659a47497c56d3df177e7c89723a2baf021936f1ac5223fbef7cb67f4b305cd
ep_bytes: 5150528d0d18000000648b0101c801c8
timestamp: 2021-08-13 11:31:43

Version Info:

LegalCopyright: Copyright (C) Valve Corporation
InternalName: Steam Client Service
FileVersion: 1, 0, 0, 1
CompanyName: Valve Corporation
ProductVersion: 1, 0, 0, 1
FileDescription: Steam Client Service
Source Control ID: 6827641
OriginalFilename: SteamService.exe
ProductName: Steam Client Service
Translation: 0x0409 0x04b0

Malware.AI.4073761772 also known as:

LionicVirus.Win32.Expiro.n!c
Elasticmalicious (high confidence)
MicroWorld-eScanWin32.Expiro.Gen.6
FireEyeGeneric.mg.951ce700ab6d2903
CylanceUnsafe
K7AntiVirusTrojan ( 00561cbf1 )
AlibabaVirus:Win32/Expiro.e4ac7500
K7GWTrojan ( 00561cbf1 )
Cybereasonmalicious.0ab6d2
CyrenW32/Expiro.AN.gen!Eldorado
SymantecML.Attribute.HighConfidence
ESET-NOD32a variant of Win32/Expiro.NDG
APEXMalicious
CynetMalicious (score: 100)
BitDefenderWin32.Expiro.Gen.6
NANO-AntivirusVirus.Win32.Gen.ccmw
AvastWin32:Xpirat-C [Inf]
TencentWin32.Virus.Expiro.Hqvc
Ad-AwareWin32.Expiro.Gen.6
SophosML/PE-A + Mal/EncPk-MK
VIPREVirus.Win32.Expiro.dp (v)
McAfee-GW-EditionBehavesLike.Win32.Virus.wc
EmsisoftWin32.Expiro.Gen.6 (B)
AviraW32/Infector.Gen8
GridinsoftRansom.Win32.Wacatac.sa
MicrosoftTrojan:Win32/Raccoon.EC!MTB
GDataWin32.Expiro.Gen.6
Acronissuspicious
ALYacWin32.Expiro.Gen.6
MAXmalware (ai score=81)
VBA32BScope.Trojan.Wacatac
MalwarebytesMalware.AI.4073761772
TrendMicro-HouseCallTROJ_GEN.R002C0RL921
IkarusVirus.Win32.Expiro
FortinetW32/Expiro.NDG
AVGWin32:Xpirat-C [Inf]
CrowdStrikewin/malicious_confidence_60% (W)

How to remove Malware.AI.4073761772?

Malware.AI.4073761772 removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment