Malware.AI.4237424912 malicious file

The Malware.AI.4237424912 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Malware.AI.4237424912 virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Behavioural detection: Executable code extraction – unpacking
• Attempts to connect to a dead IP:Port (1 unique times)
• Scheduled file move on reboot detected
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Presents an Authenticode digital signature
• Dynamic (imported) function loading detected
• Enumerates running processes
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• Unconventionial binary language: Chinese (Simplified)
• Unconventionial language used in binary resources: Chinese (Simplified)
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• The executable is compressed using UPX
• Authenticode signature is invalid
• Deletes its original binary from disk
• Installs itself for autorun at Windows startup
• CAPE detected the Zegost malware family

Related domains:

How to determine Malware.AI.4237424912?

File Info:
name: 820718AF2639E946489C.mlw
path: /opt/CAPEv2/storage/binaries/11267a2abb2846c3e7bd6f6b69bef1a1958b4e40180548262df6e16d333e9950
crc32: 368F54C3
md5: 820718af2639e946489c35182266a30c
sha1: 479e8a71370a51f2dc07e4f19ebcf5c5e00c52ca
sha256: 11267a2abb2846c3e7bd6f6b69bef1a1958b4e40180548262df6e16d333e9950
sha512: cbe2a536e6eba1cb2ebb7e5bcd1efd1220508e3e65c36e84eebdef734557ac85e624bd0edc27e8f33b2186e2cb27ca9bd0ab9502d9ceeec76fc64e853b97f7e6
ssdeep: 12288:PGXqG/H1k6hUvoNUrIE33T5zTTlL9O3ZO6epkflNaGD0u74tt+3hJLGgFqLh:PZwk6hUv/sEnnL6zLaGD46LLGnN
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1DCF423C1EB53E7E1C8EF4D38920FFB6546742502AE00095779E68E58BDFC3A2335568A
sha3_384: 2b91bf013a65893ed2637dd0a42882b1afc3f1bf155c12f7905eb48cffe849a9b2fa60db667ec650be682fe6ed0f47e5
ep_bytes: 60be00204c008dbe00f0f3ff5783cdff
timestamp: 2019-11-09 18:24:07

Version Info:
FileVersion: 1.0.0.0
FileDescription: Windows 配置程序
ProductName: Windows 核心进程
ProductVersion: 1.0.0.0
LegalCopyright: 作者版权所有 请尊重并使用正版
Comments: 本程序使用易语言编写(http://www.eyuyan.com)
Translation: 0x0804 0x04b0

Malware.AI.4237424912 also known as:

How to remove Malware.AI.4237424912?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.