Malware

What is “Malware.AI.4137616018”?

Malware Removal

The Malware.AI.4137616018 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Malware.AI.4137616018 virus can do?

  • SetUnhandledExceptionFilter detected (possible anti-debug)
  • Yara rule detections observed from a process memory dump/dropped files/CAPE
  • Possible date expiration check, exits too soon after checking local time
  • Dynamic (imported) function loading detected
  • Unconventionial binary language: Russian
  • Unconventionial language used in binary resources: Russian
  • The binary contains an unknown PE section name indicative of packing
  • The binary likely contains encrypted or compressed data.
  • The executable is compressed using UPX
  • Authenticode signature is invalid

How to determine Malware.AI.4137616018?


File Info:

name: E479094DD1D8FE9550D3.mlw
path: /opt/CAPEv2/storage/binaries/f62afd36609c25e54f86161b2e50c219ea5dbece9e769f46d66605d332daaade
crc32: 70C35C81
md5: e479094dd1d8fe9550d39740053780e2
sha1: 93a9f52be84286087834d6a7545e8b1cbb7ad110
sha256: f62afd36609c25e54f86161b2e50c219ea5dbece9e769f46d66605d332daaade
sha512: 6f365511806904843528c2b80db2a0d770b7d6b6c121e47bbcd409b1d8a81f074c137e0220743b33b237ce3d24fd1ea2fd004c058fda7f4142942904c3f94b83
ssdeep: 3072:K+qDGQebyDKjeEJgqiSP2eiLe8/Gq2CeFUzJCfaDehYbAg9u/AJOOxxSEeXq/J3a:NQPGTViSP2Re8J2AehiQxOHSERtIz
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T155340235A9E23407E94F44F5FB5F41ACAD0A9C86EE6EE204493CB60A207B015C6E7F53
sha3_384: 69e9013fc603c3f1a407a9ab0db4709c1990225a77428540baf70d0f215006bd9f737c7d80d17df7fb4a5222499e2cce
ep_bytes: 60be00e041008dbe0030feff57eb0b90
timestamp: 2018-12-14 16:02:35

Version Info:

FileDescription: 34trthsr serte hseh se
FileVersion: s sthsths hr
InternalName: ht sthths
LegalCopyright: hsehhsh
LegalTrademarks: s h
OriginalFilename: sthsthshth
ProductName: shhst hh
ProductVersion: sthst hst hrt htrhsthrt
Translation: 0x0419 0x04b0

Malware.AI.4137616018 also known as:

Elasticmalicious (moderate confidence)
DrWebTrojan.PWS.Stealer.25327
MicroWorld-eScanGen:Variant.Jaik.46119
FireEyeGeneric.mg.e479094dd1d8fe95
McAfeeGenericRXAA-FA!E479094DD1D8
CylanceUnsafe
SangforSuspicious.Win32.Save.a
K7AntiVirusPassword-Stealer ( 0052f9a71 )
AlibabaTrojanPSW:Win32/MoksSteal.22058b8d
K7GWPassword-Stealer ( 0052f9a71 )
Cybereasonmalicious.dd1d8f
BitDefenderThetaGen:NN.ZexaF.34712.omNfaex@xinc
CyrenW32/Kryptik.FQE.gen!Eldorado
tehtrisGeneric.Malware
ESET-NOD32Win32/PSW.Delf.OSF
Paloaltogeneric.ml
ClamAVWin.Malware.Azorult-7668229-0
KasperskyHEUR:Trojan.Win32.Generic
BitDefenderGen:Variant.Jaik.46119
NANO-AntivirusTrojan.Win32.Azorult.flhrhk
SUPERAntiSpywareTrojan.Agent/Gen-Ursnif
AvastWin32:Malware-gen
TencentMalware.Win32.Gencirc.114d53c3
Ad-AwareGen:Variant.Jaik.46119
EmsisoftGen:Variant.Jaik.46119 (B)
ComodoMalware@#xgeftlmcf4el
ZillyaTrojan.Azorult.Win32.14
McAfee-GW-EditionBehavesLike.Win32.Generic.dc
SophosMal/Generic-S
IkarusTrojan.Win32.Generic
JiangminTrojan.PSW.Azorult.gm
WebrootW32.Trojan.Gen
AviraTR/AD.MoksSteal.zobaw
MicrosoftTrojan:Win32/Occamy.C
GDataGen:Variant.Jaik.46119
CynetMalicious (score: 100)
AhnLab-V3Trojan/Win32.Agent.C2898628
VBA32TrojanPSW.Azorult
ALYacGen:Variant.Jaik.46119
MalwarebytesMalware.AI.4137616018
APEXMalicious
RisingStealer.Delf!8.415 (CLOUD)
MAXmalware (ai score=100)
FortinetW32/Injector.ECJD!tr
AVGWin32:Malware-gen
PandaTrj/GdSda.A
CrowdStrikewin/malicious_confidence_100% (D)

How to remove Malware.AI.4137616018?

Malware.AI.4137616018 removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment