Malware

Malware.AI.4230390294 removal tips

Malware Removal

The Malware.AI.4230390294 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Malware.AI.4230390294 virus can do?

  • Executable code extraction
  • Creates RWX memory
  • Detected script timer window indicative of sleep style evasion
  • Attempts to connect to a dead IP:Port (5 unique times)
  • Reads data out of its own binary image
  • Drops a binary and executes it
  • Performs some HTTP requests
  • A scripting utility was executed
  • Creates or sets a registry key to a long series of bytes, possibly to store a binary or malware config
  • Installs itself for autorun at Windows startup
  • A wscript.exe process commonly used in script or document file downloaders initiated network activity
  • Attempts to identify installed AV products by installation directory
  • Checks the CPU name from registry, possibly for anti-virtualization
  • Attempts to modify proxy settings
  • Anomalous binary characteristics

Related domains:

z.whorecord.xyz
a.tomx.xyz
ip-api.com
iplogger.org
ocsp.comodoca.com
ocsp.usertrust.com
ocsp.sectigo.com

How to determine Malware.AI.4230390294?


File Info:

crc32: 57E630BE
md5: f6ce5fffe62aa95deff57bc6373099bc
name: F6CE5FFFE62AA95DEFF57BC6373099BC.mlw
sha1: 004cfb09ef36923d7caa0fceaa86300e004a65e3
sha256: 7c0277db66d5c01dd1c7835f266773357f1399a374cfa6bfba284e13965eaacb
sha512: cbd0d782a61205d8b9453c5411b71c036757461e0a81ee9b45d0d85d3ba705aca39164daca50d509c918973fb652ea970c17ee86975af3ac5ef381e0571d334c
ssdeep: 12288:c0gb5fdyZTg1JtMAkUytSFD3LTti1k6nUh1lTSM+c04rn2:3C1Zx3ygF7LMZUltK4rn2
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

LegalCopyright: Group of activities
ProductVersion: 1.0.0.0
FileVersion: 1.0.0.0
FileDescription:
Translation: 0x0000 0x04b0

Malware.AI.4230390294 also known as:

CynetMalicious (score: 100)
ALYacGen:Variant.Doina.10795
CylanceUnsafe
ZillyaTrojan.Swisyn.Win32.35463
SangforTrojan.Win32.Save.a
CrowdStrikewin/malicious_confidence_60% (W)
AlibabaRansom:Win32/Sodinokibi.fb54ebb3
Cybereasonmalicious.9ef369
SymantecML.Attribute.HighConfidence
ESET-NOD32multiple detections
APEXMalicious
AvastWin32:PWSX-gen [Trj]
KasperskyHEUR:Trojan.Win32.Chapak.gen
BitDefenderDropped:Trojan.GenericKD.46293826
MicroWorld-eScanGen:Variant.Doina.10795
TencentWin32.Trojan-qqpass.Qqrob.Efba
Ad-AwareGen:Variant.Doina.10795
BitDefenderThetaGen:NN.ZexaF.34690.tqW@ambEZtfO
McAfee-GW-EditionBehavesLike.Win32.Dropper.hc
FireEyeGen:Variant.Doina.10795
EmsisoftGen:Variant.Doina.10795 (B)
WebrootW32.Trojan.Multi.GenML.xnet
MicrosoftRansom:Win32/Sodinokibi.F
AegisLabTrojan.Win32.Chapak.4!c
GDataWin32.Trojan-Stealer.Clipper.LTH31Y
AhnLab-V3Trojan/Win.Generic.C4472125
McAfeeArtemis!F6CE5FFFE62A
MAXmalware (ai score=81)
MalwarebytesMalware.AI.4230390294
PandaTrj/CI.A
RisingMalware.Obscure/Heur!1.A89F (CLOUD)
IkarusTrojan.Win32.Crypt
AVGWin32:PWSX-gen [Trj]

How to remove Malware.AI.4230390294?

Malware.AI.4230390294 removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment