Malware

Malware.AI.4237955174 malicious file

Malware Removal

The Malware.AI.4237955174 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Malware.AI.4237955174 virus can do?

  • Behavioural detection: Executable code extraction – unpacking
  • Yara rule detections observed from a process memory dump/dropped files/CAPE
  • Creates RWX memory
  • Possible date expiration check, exits too soon after checking local time
  • Dynamic (imported) function loading detected
  • Reads data out of its own binary image
  • CAPE extracted potentially suspicious content
  • Unconventionial language used in binary resources: Russian
  • The binary contains an unknown PE section name indicative of packing
  • Authenticode signature is invalid
  • Anomalous binary characteristics

How to determine Malware.AI.4237955174?


File Info:

name: DF504039D42EDF8E4E44.mlw
path: /opt/CAPEv2/storage/binaries/651404e768a5e3fad5fda785faca3a64c3a95ce5126cbec8174e4e4f0d183574
crc32: 87944E2C
md5: df504039d42edf8e4e44a021b8265280
sha1: e571ac05d9662a006f3ff06c3dc0482430d94285
sha256: 651404e768a5e3fad5fda785faca3a64c3a95ce5126cbec8174e4e4f0d183574
sha512: cb79004e286ac0c06a10267e318ca07d9bb63af7d0b8acce909b744acafed298fadd4f5e41e846a0cec63228fa8bfe7650b67e5fe8fd3bd240efbca323ace6ea
ssdeep: 6144:+30L4EWHJD7l3ITn3ohTm5pPMaYy6BCrNQWx:n4Ewhm4RmTUBCBh
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T123140115790B66F2D872C9BC8F73E2354028AE72EDC086D3BAD91D58F0912C7272975E
sha3_384: debb89fb145c9750e1c20fe7fdc4f5ce67efeb44081f3d210d1e5a718b6580cc29145940049f434cd82442d6cdb2bf94
ep_bytes: 833defd04200fd8b05f0d0420085c074
timestamp: 1992-06-19 22:22:17

Version Info:

0: [No Data]

Malware.AI.4237955174 also known as:

BkavW32.AIDetect.malware2
LionicTrojan.Win32.Generic.lxlK
Elasticmalicious (high confidence)
MicroWorld-eScanGen:Variant.Graftor.675254
FireEyeGeneric.mg.df504039d42edf8e
CAT-QuickHealTrojan.Kanots.A
ALYacGen:Variant.Graftor.675254
CylanceUnsafe
ZillyaTrojan.Zbot.Win32.62635
SangforSuspicious.Win32.Save.a
CrowdStrikewin/malicious_confidence_100% (W)
AlibabaTrojanSpy:Win32/EncPk.7550bc93
K7GWTrojan ( 7000000f1 )
K7AntiVirusTrojan ( 7000000f1 )
BaiduWin32.Virus.Krap.a
VirITTrojan.Win32.Generic.CNOD
CyrenW32/Zbot.QM.gen!Eldorado
SymantecPacked.Generic.382
ESET-NOD32Win32/Spy.Zbot.YW
APEXMalicious
Paloaltogeneric.ml
ClamAVWin.Trojan.Zbot-40446
KasperskyHEUR:Trojan.Win32.Generic
BitDefenderGen:Variant.Graftor.675254
NANO-AntivirusTrojan.Win32.SmsSend.cbobaq
SUPERAntiSpywareTrojan.Agent/Gen-Kazy
AvastWin32:Susn-AU [Trj]
TencentMalware.Win32.Gencirc.114c3d2a
Ad-AwareGen:Variant.Graftor.675254
TACHYONTrojan-Spy/W32.ZBot.199681
EmsisoftGen:Variant.Graftor.675254 (B)
ComodoTrojWare.Win32.Spy.ZBot.EACK@4pmhx4
DrWebTrojan.SMSSend.2363
VIPRETrojan.Win32.Generic!BT
McAfee-GW-EditionBehavesLike.Win32.ZBot.ch
SophosMal/Generic-R + Mal/EncPk-AEH
IkarusTrojan-PWS.Win32.Zbot
GDataGen:Variant.Graftor.675254
JiangminTrojan/Birele.bdm
WebrootW32.InfoStealer.Zeus
AviraDR/Delphi.Gen7
Antiy-AVLTrojan[Spy]/Win32.Zbot
KingsoftWin32.Troj.Zbot.(kcloud)
ArcabitTrojan.Graftor.DA4DB6
ZoneAlarmHEUR:Trojan.Win32.Generic
MicrosoftPWS:Win32/Zbot
CynetMalicious (score: 100)
AhnLab-V3Trojan/Win32.Zbot.R27819
Acronissuspicious
McAfeePWS-Zbot.gen.bdn
MAXmalware (ai score=100)
VBA32TrojanSpy.Zbot
MalwarebytesMalware.AI.4237955174
RisingSpyware.Voltar!1.AF1D (CLOUD)
YandexTrojan.GenAsa!NBaBu86kvbk
SentinelOneStatic AI – Malicious PE
MaxSecureTrojan.Malware.7164915.susgen
FortinetW32/Zbot.EQPB!tr
BitDefenderThetaGen:NN.ZexaF.34212.mGX@aqKPTFfk
AVGWin32:Susn-AU [Trj]
PandaTrj/Pacrypt.D

How to remove Malware.AI.4237955174?

Malware.AI.4237955174 removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment