Malware.AI.4226525870 removal guide

The Malware.AI.4226525870 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Malware.AI.4226525870 virus can do?

The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
Binary compilation timestomping detected

How to determine Malware.AI.4226525870?


File Info:
name: 0B9F3E439F289546B8D7.mlw
path: /opt/CAPEv2/storage/binaries/5ede65e40594007d058b192e489592c082f7d722da3bf6182043ac5f5c1d11ae
crc32: B91731C3
md5: 0b9f3e439f289546b8d7a3d75752a9de
sha1: 868b3d22919763690d4d60fec216293bc768156b
sha256: 5ede65e40594007d058b192e489592c082f7d722da3bf6182043ac5f5c1d11ae
sha512: 809b2184179b22a004096d8d33a498ba4874f06173025b0a71df83bb87ecbbf4923ea25faacb55c4a218a20478aa27ae9cb6bf33d499d40f691fa5e5152169ec
ssdeep: 6144:jKbwIGFMKTpt6A+9E83RVwFWeoR+zQoGeaR0+qmz4RWWZ9L+HVmFHOTb8KixCWN2:WETSVPR+xaeJm8RbZZ+EFHi8FE0Ek
type: PE32 executable (console) Intel 80386, for MS Windows
tlsh: T11E947C43A10905CCFFBBF17EDA7AB70CA07917A1DF5499706DB9B8360CB5A902B084D9
sha3_384: 67bcac23259a83bae2778708ab5aadc970b030719f58570712ed7615545accc0684e5352cb3f3e0015b0c2847734c155
ep_bytes: 5653522bf683c630648b1e518b4b084b
timestamp: 2070-05-26 09:39:29

Version Info:
CompanyName: Microsoft Corporation
FileDescription: x86 Performance Counter Host
FileVersion: 10.0.17134.1 (WinBuild.160101.0800)
InternalName: perfhost.exe
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFilename: perfhost.exe
ProductName: Microsoft® Windows® Operating System
ProductVersion: 10.0.17134.1
Translation: 0x0409 0x04b0

Malware.AI.4226525870 also known as:

MicroWorld-eScan	Win32.Expiro.Gen.6
FireEye	Generic.mg.0b9f3e439f289546
ALYac	Win32.Expiro.Gen.6
Cylance	Unsafe
K7AntiVirus	Virus ( 00580a951 )
K7GW	Virus ( 00580a951 )
Cybereason	malicious.39f289
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/Expiro.CP
TrendMicro-HouseCall	Virus.Win32.EXPIRO.AD
BitDefender	Win32.Expiro.Gen.6
NANO-Antivirus	Virus.Win32.Gen.ccmw
Avast	Win32:Xpirat-C [Inf]
Ad-Aware	Win32.Expiro.Gen.6
Sophos	ML/PE-A
TrendMicro	Virus.Win32.EXPIRO.AD
McAfee-GW-Edition	BehavesLike.Win32.Generic.gc
Emsisoft	Win32.Expiro.Gen.6 (B)
SentinelOne	Static AI – Malicious PE
GData	Win32.Expiro.Gen.6
Avira	TR/Patched.Gen
MAX	malware (ai score=85)
Arcabit	Win32.Expiro.Gen.6
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
Cynet	Malicious (score: 100)
VBA32	BScope.Trojan.Wacatac
Malwarebytes	Malware.AI.4226525870
APEX	Malicious
AVG	Win32:Xpirat-C [Inf]
CrowdStrike	win/malicious_confidence_90% (D)

How to remove Malware.AI.4226525870?

Malware.AI.4226525870 removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X