About “Malware.AI.4226866749” infection

The Malware.AI.4226866749 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Malware.AI.4226866749 virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Behavioural detection: Executable code extraction – unpacking
• At least one process apparently crashed during execution
• Executed a command line with /C or /R argument to terminate command shell on completion which can be used to hide execution
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Possible date expiration check, exits too soon after checking local time
• Dynamic (imported) function loading detected
• Enumerates running processes
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• A scripting utility was executed
• Uses Windows utilities for basic functionality
• Behavioural detection: Injection (Process Hollowing)
• Executed a process and injected code into it, probably while unpacking
• Behavioural detection: Injection (inter-process)
• Installs itself for autorun at Windows startup
• CAPE detected the DarkComet malware family
• Anomalous binary characteristics

How to determine Malware.AI.4226866749?

File Info:
name: FECA7ECB949F5E5F2451.mlw
path: /opt/CAPEv2/storage/binaries/fa1fbc872682b5cedab4495d9fa616f475a1a2c89bfe99b0501e7307c1885737
crc32: 8280592C
md5: feca7ecb949f5e5f2451208253f0d3f9
sha1: f6230d31f1f0412ac8fa663360f748baf4a198dc
sha256: fa1fbc872682b5cedab4495d9fa616f475a1a2c89bfe99b0501e7307c1885737
sha512: b9cc38a6c30ffbb427891cca9ebeef7685038f2cfb17fc8d3dac62a300a6925c7aec69eb654bb8f3212d997a3076acd45289e509245b9af65d2a8cccb92f3d78
ssdeep: 24576:9Z+cQCaE5Gn4PyEWQVUPMVXulpXc1wG8coUJ/0txKELhSf:P+cQCYn4BWQVUk+zXc1wGzoUJ/0txKZ
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1A935F13565801861C4EC123C4DDFE031CA5D3FFBC9A85A29A5D6F9F736B29A07434ACA
sha3_384: a1973b4f438cc45f2c7eef13befac06fa8e1c18ac32f7b264a72015d50cc89ca0ba85064dd61a72f59e0daf2a76b9dc6
ep_bytes: e80a000000e97affffffcccccccccc8b
timestamp: 2004-08-04 06:01:37

Version Info:
CompanyName: Microsoft Corporation
FileDescription: Win32 Cabinet Self-Extractor                                           
FileVersion: 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)
InternalName: Wextract                
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFilename: WEXTRACT.EXE            
ProductName: Microsoft® Windows® Operating System
ProductVersion: 6.00.2900.2180
Translation: 0x0409 0x04b0

Malware.AI.4226866749 also known as:

How to remove Malware.AI.4226866749?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.