Malware

About “Malware.AI.4133069861” infection

Malware Removal

The Malware.AI.4133069861 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Malware.AI.4133069861 virus can do?

  • Behavioural detection: Executable code extraction – unpacking
  • Executed a command line with /C or /R argument to terminate command shell on completion which can be used to hide execution
  • Sample contains Overlay data
  • Yara rule detections observed from a process memory dump/dropped files/CAPE
  • Presents an Authenticode digital signature
  • Reads data out of its own binary image
  • CAPE extracted potentially suspicious content
  • Drops a binary and executes it
  • Authenticode signature is invalid
  • Uses Windows utilities for basic functionality
  • Detects Bochs through the presence of a registry key
  • Anomalous binary characteristics

How to determine Malware.AI.4133069861?


File Info:

name: 418FC3996A42CFAA434C.mlw
path: /opt/CAPEv2/storage/binaries/c33be81771f3989c5fa2c1e73868ebd8a49a0d768e00e9b19aa5e21023769d9f
crc32: 8293DC8C
md5: 418fc3996a42cfaa434c7ccd6fcd0bd2
sha1: 100cccaf1e3c3b92549b3cc5f6867e3c311e99dc
sha256: c33be81771f3989c5fa2c1e73868ebd8a49a0d768e00e9b19aa5e21023769d9f
sha512: b12c7f0d77bde0dcb340658b40b0a4a9f1a3ed10cc7e5a20dc1e7d6b8ca6a884b511531d4fe8c8173a1d3570ecb89fbed47b0e163a05c6de61c732c86a03b1ce
ssdeep: 12288:+lOkx7BBrvoRCxOVmv5F0NIjjpiNmBUKd2KIce2TfH2j9p5zx/8BPxZs+O67LBoQ:7MLreCxv5LjV1XkKdf+59KZ2I7EpzX0
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1B6656A0137E45636E4BF2BBAD8B6451047B8B152AB67E3CF1AD458FD1DA27C099303A3
sha3_384: 4674fedbfa517d900729165b116f370689d9b2e6da6fdf1706dc33a32d5962632e6f8c74b15ce5ba139dd0ab06fa1b97
ep_bytes: e843ec0000e989feffffff35383b4500
timestamp: 2015-01-07 07:54:34

Version Info:

0: [No Data]

Malware.AI.4133069861 also known as:

MicroWorld-eScanGen:Variant.Zusy.434573
FireEyeGeneric.mg.418fc3996a42cfaa
McAfeeGenericR-GSO!418FC3996A42
MalwarebytesMalware.AI.4133069861
VIPREGen:Variant.Zusy.434573
K7AntiVirusSpyware ( 0054aa6f1 )
K7GWSpyware ( 0054aa6f1 )
Cybereasonmalicious.96a42c
VirITTrojan.Win32.X-MSIL.A
Elasticmalicious (high confidence)
ESET-NOD32a variant of Win32/GenKryptik.BSWX
KasperskyTrojan.Win32.Reconyc.ecpf
BitDefenderGen:Variant.Zusy.434573
NANO-AntivirusTrojan.Win32.Reconyc.eguzgf
AvastWin32:TrojanX-gen [Trj]
TencentMalware.Win32.Gencirc.114bd9fc
Ad-AwareGen:Variant.Zusy.434573
EmsisoftGen:Variant.Zusy.434573 (B)
DrWebTrojan.MulDrop6.36189
ZillyaTrojan.Reconyc.Win32.24640
McAfee-GW-EditionGenericR-GSO!418FC3996A42
GDataGen:Variant.Zusy.434573
AviraTR/Spy.Agent.gwpax
MAXmalware (ai score=87)
Antiy-AVLTrojan/Generic.ASMalwS.35E5
ArcabitTrojan.Zusy.D6A18D
ZoneAlarmTrojan.Win32.Reconyc.ecpf
MicrosoftTrojan:Win32/Sabsik.FL.B!ml
CynetMalicious (score: 100)
AhnLab-V3Trojan/Win.Reconyc.C5216091
VBA32BScope.Adware.Fiseria
ALYacGen:Variant.Zusy.434573
CylanceUnsafe
RisingMalware.Undefined!8.C (TFE:5:7uF0wTX7r8Q)
YandexTrojan.Reconyc!tg+4cgaK09Q
SentinelOneStatic AI – Suspicious PE
BitDefenderThetaGen:NN.ZemsilF.34646.dn0@au91Pch
AVGWin32:TrojanX-gen [Trj]
CrowdStrikewin/grayware_confidence_60% (D)

How to remove Malware.AI.4133069861?

Malware.AI.4133069861 removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment