Malware

Should I remove “Malware.AI.4211234360”?

Malware Removal

The Malware.AI.4211234360 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Malware.AI.4211234360 virus can do?

  • SetUnhandledExceptionFilter detected (possible anti-debug)
  • Yara rule detections observed from a process memory dump/dropped files/CAPE
  • Creates RWX memory
  • Dynamic (imported) function loading detected
  • Reads data out of its own binary image
  • Attempts to modify Internet Explorer’s start page
  • The binary contains an unknown PE section name indicative of packing
  • The binary likely contains encrypted or compressed data.
  • The executable is compressed using UPX
  • Creates an autorun.inf file
  • Authenticode signature is invalid
  • Installs itself for autorun at Windows startup

Related domains:

n73fu7.wayout.pictures
mega.nz
wpad.local-net
ZnkZADf.TZwLAZrKaaqyIcaAkGmg.readme.io
kaPlyZySYK.KhuyYXfvvIusoeKqHVjV.readme.io
kU.TiXaBkrXkmfERJUzZypI.readme.io
www.apkmirror.com
www.bates.edu
qnagIofbV.IbRehRYCwyGrCHcShUHt.readme.io
jmbvmwp.mxp4037.com
LAfqIZuUm.bitbucket.com
vxgjlT.bitbucket.com
sSBgmQdjSEuC.bitbucket.com
KmyX.hLKqecIrvUOhMSYkMiZC.readme.io
TjhpsvuNyTxW.OtGzjaWKaEWhNVwZDyVm.readme.io
HugwWHGfqxIB.FXtcaFhjSpZvZOPxjPOO.readme.io
pYlsBpIxgLzi.LzknHLAaUMMmXQKdQRIL.readme.io
PrZlY.OVdFQUujoEbnJTPggNSU.readme.io
FLvz.lSLTjCvRFobamkLJVSKv.readme.io
FstcPoOrgSvoE.mRTcGVUVuMeUvCpSUAwC.readme.io

How to determine Malware.AI.4211234360?


File Info:

name: 3D77BBEE5B6129EDE8F8.mlw
path: /opt/CAPEv2/storage/binaries/f845d6fee95161f91845dca77df94076cba1d245e91f0e988738c71b35679156
crc32: 05EE9A03
md5: 3d77bbee5b6129ede8f883d4198e29f1
sha1: 83e6cdcc450a23fdcaec18987d073f7e67f69c16
sha256: f845d6fee95161f91845dca77df94076cba1d245e91f0e988738c71b35679156
sha512: 016bcb9232dc2cf6ca4b3907ad522b65ecb976d4416686e0b0d3fa6f487759ef77a81104529d6ca2267556513cd8323e602aa3725cda6d31a0814a50f7d04463
ssdeep: 98304:FpNKF1v29SlR/7M2XbCrVL50E3s45b4D4B2YH1Y1Mbizegf:FmF1v296hZXgaEc484vH1Hiigf
type: PE32+ executable (console) x86-64, for MS Windows
tlsh: T16F363343FEC81489E6FAA5327253C4A27CBD8CF9AE058B0476F1EA8179065773257F81
sha3_384: 2708e46903256031aa0676e3a2ad4b6f394abaabcff9371d4d02e65ff2a1d904d0c51874410fd82ac006d876289ca995
ep_bytes: 53565755488d35ea61bbff488dbedbbf
timestamp: 2019-12-05 22:07:37

Version Info:

0: [No Data]

Malware.AI.4211234360 also known as:

Elasticmalicious (high confidence)
CynetMalicious (score: 100)
FireEyeGeneric.mg.3d77bbee5b6129ed
McAfeeTrickbot-FRE!3D77BBEE5B61
CylanceUnsafe
ZillyaTrojan.Emotet.Win32.15917
K7AntiVirusTrojan ( 0055e5891 )
K7GWTrojan ( 0055e5891 )
Cybereasonmalicious.e5b612
CyrenW32/Kryptik.AEK.gen!Eldorado
SymantecPacked.Generic.534
ESET-NOD32a variant of Win64/CoinMiner.AEF.gen
APEXMalicious
ClamAVWin.Malware.Tofsee-7057860-0
KasperskyTrojan.Win64.Pakes.l
BitDefenderGen:Variant.Razy.560742
NANO-AntivirusTrojan.Win32.GenKryptik.focjuh
MicroWorld-eScanGen:Variant.Razy.560742
AvastWin32:ReposFxg-F [Trj]
Ad-AwareGen:Variant.Razy.560742
EmsisoftGen:Variant.Razy.560742 (B)
DrWebTrojan.Siggen8.17135
TrendMicroTrojan.Win64.PAKES.SM
McAfee-GW-EditionBehavesLike.Win64.Trickbot.rc
SophosML/PE-A + Mal/HckPk-R
IkarusVirus.Win32.Ramnit
GDataGen:Variant.Razy.560742
AviraTR/Crypt.ULPM.Gen
Antiy-AVLTrojan/Generic.ASBOL.C626
MicrosoftTrojan:Win32/SmokeLoader
AhnLab-V3Trojan/Win64.Trickster.R302816
Acronissuspicious
VBA32Trojan.Win64.Pakes
ALYacGen:Variant.Razy.560742
MAXmalware (ai score=84)
MalwarebytesMalware.AI.4211234360
TrendMicro-HouseCallTrojan.Win64.PAKES.SM
RisingTrojan.Kryptik!1.C31C (CLASSIC)
YandexTrojan.GenAsa!ZRYTwt90J5E
SentinelOneStatic AI – Malicious PE
FortinetW64/Kryptik.BTT!tr
BitDefenderThetaGen:NN.ZexaF.34294.luW@aq5RFHdi
AVGWin32:ReposFxg-F [Trj]
CrowdStrikewin/malicious_confidence_100% (D)
MaxSecureTrojan.Malware.121218.susgen

How to remove Malware.AI.4211234360?

Malware.AI.4211234360 removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment