Should I remove “Malware.AI.4200408077”?

The Malware.AI.4200408077 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Malware.AI.4200408077 virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Behavioural detection: Executable code extraction – unpacking
• At least one process apparently crashed during execution
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Dynamic (imported) function loading detected
• Performs HTTP requests potentially not found in PCAP.
• HTTPS urls from behavior.
• A named pipe was used for inter-process communication
• Enumerates the modules from a process (may be used to locate base addresses in process injection)
• A process created a hidden window
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• The executable is compressed using UPX
• Authenticode signature is invalid
• Uses Windows utilities for basic functionality
• Attempts to modify desktop wallpaper
• Deletes its original binary from disk
• Collects and encrypts information about the computer likely to send to C2 server
• Installs itself for autorun at Windows startup
• Installs itself for autorun at Windows startup
• Creates a hidden or system file
• CAPE detected the PCRat malware family
• Creates a copy of itself
• Harvests cookies for information gathering
• Uses suspicious command line tools or Windows utilities

Related domains:

How to determine Malware.AI.4200408077?

File Info:
name: 128AFFF4F6DDC26DB8D9.mlw
path: /opt/CAPEv2/storage/binaries/5ad17af638434f811d02ffdf620938f1e2eceb7057b3d7822a012f1d553acce7
crc32: 7912B195
md5: 128afff4f6ddc26db8d934dd4f464922
sha1: c6c0f16be7954e7ca68458bb64de47bef513df6a
sha256: 5ad17af638434f811d02ffdf620938f1e2eceb7057b3d7822a012f1d553acce7
sha512: 1deea1948d17f1e8f2a10ff754b6219309e4023ce5b1dd931cadcf8c0d67268b2d3c3f820e9172749151e170180cf59725b66b38cc15ca1781e8191fc0d90fb8
ssdeep: 3072:7NStRuugK48uk303XVHozh3DnS0BVyVABRnzDBpLwmc:UtMugmukkXmzJ+0BsVABRHBpLw
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T16CE31243F60B5B56D182033E0F49AE81EA953DEF809A0394974195673BB37F03F79689
sha3_384: 44a3b7ebd5a5720b846b3682a836fcb5356ae967a30e068eb18c34b60450fee33f7640704383b0512e5a48268225dc87
ep_bytes: 60be006042008dbe00b0fdff5783cdff
timestamp: 2017-07-30 09:34:15

Version Info:
0: [No Data]

Malware.AI.4200408077 also known as:

How to remove Malware.AI.4200408077?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.