Malware

Malware.AI.4221312898 (file analysis)

Malware Removal

The Malware.AI.4221312898 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Malware.AI.4221312898 virus can do?

  • Executable code extraction
  • Creates RWX memory
  • Possible date expiration check, exits too soon after checking local time
  • A process attempted to delay the analysis task.
  • Attempts to connect to a dead IP:Port (6 unique times)
  • Starts servers listening on 0.0.0.0:5405
  • Reads data out of its own binary image
  • A process created a hidden window
  • Drops a binary and executes it
  • HTTP traffic contains suspicious features which may be indicative of malware related traffic
  • Performs some HTTP requests
  • Uses Windows utilities for basic functionality
  • Collects information about installed applications
  • Creates a hidden or system file
  • Attempts to modify proxy settings
  • Uses suspicious command line tools or Windows utilities

Related domains:

inloadfile.com
geo.netsupportsoftware.com
clothesonlinemarket.xyz
st.priceyam.xyz
www.bing.com
apt-vict.info
distribute.takemyfile.net
ocsp.digicert.com

How to determine Malware.AI.4221312898?


File Info:

crc32: 1D67C5F0
md5: 628513fc58382daa181cc803bafcdf0b
name: 628513FC58382DAA181CC803BAFCDF0B.mlw
sha1: 58783830fb99153d803c89dc2756d7ae03692e26
sha256: 34328d5bc9027217ed0c59e54b701ae068c45561acb4acef61f21ef98264cd6b
sha512: 0835351dca8d8f279fd14cac2987442053ed448b4c16db53fa579c4694b44ef71f7be42acd46d6ce8fbec245fdea6c680578e871cbce5c731a018d3ada9f8a59
ssdeep: 24576:N4nXubIQGyxbPV0db263bqKnxC6+vogz2dbFFv0S6dS/01icZOEOR5QvrO:Nqe3f6P5L+DidXvh6dS/04OOR5QvrO
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

LegalCopyright:
FileVersion:
CompanyName:
Comments: This installation was built with Inno Setup.
ProductName: 4K Video Downloader 4 14 0 4010
ProductVersion: 1.0
FileDescription: 4K Video Downloader 4 14 0 4010 Setup
OriginalFileName:
Translation: 0x0000 0x04b0

Malware.AI.4221312898 also known as:

BkavW32.AIDetect.malware1
K7AntiVirusRiskware ( 0040eff71 )
DrWebTrojan.PWS.Stealer.30446
CynetMalicious (score: 99)
CylanceUnsafe
SangforTrojan.Win32.Save.a
AlibabaTrojanBanker:Win32/ChePro.2e83d247
K7GWRiskware ( 0040eff71 )
SymantecTrojan.Gen.MBT
AvastFileRepMalware
KasperskyTrojan-Banker.Win32.ChePro.niag
BitDefenderTrojan.GenericKD.46366078
MicroWorld-eScanTrojan.GenericKD.46366078
Ad-AwareTrojan.GenericKD.46366078
SophosMal/Generic-S
McAfee-GW-EditionBehavesLike.Win32.CSDIMonetize.tc
FireEyeTrojan.GenericKD.46366078
EmsisoftTrojan.GenericKD.46366078 (B)
AviraTR/Spy.ChePro.jqera
KingsoftWin32.Troj.Banker.(kcloud)
MicrosoftTrojan:Win32/Wacatac.B!ml
AegisLabTrojan.Win32.ChePro.7!c
ZoneAlarmTrojan-Banker.Win32.ChePro.niag
GDataTrojan.GenericKD.46366078
AhnLab-V3Malware/Win.Generic.C4488439
McAfeeArtemis!628513FC5838
MAXmalware (ai score=88)
VBA32Backdoor.Agent
MalwarebytesMalware.AI.4221312898
IkarusTrojan.Spy.ChePro
MaxSecureTrojan.Malware.118262833.susgen
FortinetMalicious_Behavior.SB
AVGFileRepMalware
Paloaltogeneric.ml

How to remove Malware.AI.4221312898?

Malware.AI.4221312898 removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment