Categories: Malware

Malware.AI.4199229654 malicious file

The Malware.AI.4199229654 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Malware.AI.4199229654 virus can do?

SetUnhandledExceptionFilter detected (possible anti-debug)
Creates RWX memory
Guard pages use detected – possible anti-debugging.
Dynamic (imported) function loading detected
CAPE extracted potentially suspicious content
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
Collects and encrypts information about the computer likely to send to C2 server
Network activity detected but not expressed in API logs

Related domains:

wpad.local-net

How to determine Malware.AI.4199229654?


File Info:
name: 0C19530D67B02737256A.mlwpath: /opt/CAPEv2/storage/binaries/26ec5dcdf0e5ed8b2d53183d01b30a64191e296bfef1c9f3de5706bfa015155fcrc32: 97B40530md5: 0c19530d67b02737256a0466a4077926sha1: f325879a001d32db22e7389e3de299631d66fb6csha256: 26ec5dcdf0e5ed8b2d53183d01b30a64191e296bfef1c9f3de5706bfa015155fsha512: f2b0073977f0277fdfca22a8884d1a29e4de66c802d5dcb259c08ab7fc4c5c7263e7ed771414101e0cdf0c6228cfe2cf4ddff96549e57223f91e1230d8805812ssdeep: 24576:8mhA6BlzXDUux9eBSx0mU2nZRZqezJ2L/1FtdBGjXusSwV9e5/vY+wyO9nXzwtVb:8mhAWl7DUux9eBl2RLJ2L/1FtwXoYY/Vtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T13865010388B0167BF6F85732A8D3B87DC9D31C59B1B2E405E5EE6B442993AD1F83417Asha3_384: 7c2f39568fcc9cf23f4c7acbdf18790cd8f24bfcc37c1595634f09c1bd99d4a89a7206a2f84a66dd8790e528391e9392ep_bytes: ff250020400000000000000000000000timestamp: 2017-11-09 22:05:45
Version Info:
Translation: 0x0000 0x04b0Comments: Application based on SMath Viewer Desktop.CompanyName: Andrey Ivashov (SMath)FileDescription: 316637 BTS OpenCircuitSolution R3.exeFileVersion: 1.35.6522.25372InternalName: 316637 BTS OpenCircuitSolution R3.exe.tmpLegalCopyright: Copyright © SMath 2017OriginalFilename: 316637 BTS OpenCircuitSolution R3.exe.tmpProductName: SMath Viewer DesktopProductVersion: 1.35.6522.25372Assembly Version: 1.35.6522.25372

Malware.AI.4199229654 also known as:

Lionic	Riskware.Win32.Razy.1!c
McAfee	Artemis!0C19530D67B0
BitDefenderTheta	Gen:NN.ZemsilF.34294.Bn0@aqJo36d
APEX	Malicious
BitDefender	Gen:Variant.Lazy.15200
MicroWorld-eScan	Gen:Variant.Lazy.15200
Ad-Aware	Gen:Variant.Lazy.15200
FireEye	Generic.mg.0c19530d67b02737
Emsisoft	Gen:Variant.Lazy.15200 (B)
GData	Gen:Variant.Lazy.15200
eGambit	Unsafe.AI_Score_100%
Microsoft	Trojan:Win32/Sabsik.TE.B!ml
ALYac	Gen:Variant.Lazy.15200
MAX	malware (ai score=85)
Malwarebytes	Malware.AI.4199229654
TrendMicro-HouseCall	TROJ_GEN.R002H09KF21
SentinelOne	Static AI – Suspicious PE
MaxSecure	Trojan.Malware.300983.susgen