Malware

How to remove “Malware.AI.4261039841”?

Malware Removal

The Malware.AI.4261039841 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Malware.AI.4261039841 virus can do?

  • Executable code extraction
  • Injection (inter-process)
  • Injection (Process Hollowing)
  • Compression (or decompression)
  • Possible date expiration check, exits too soon after checking local time
  • Creates RWX memory
  • Attempts to connect to a dead IP:Port (12 unique times)
  • At least one IP Address, Domain, or File Name was found in a crypto call
  • Starts servers listening on 127.0.0.1:0
  • Expresses interest in specific running processes
  • Reads data out of its own binary image
  • A process created a hidden window
  • Drops a binary and executes it
  • HTTP traffic contains suspicious features which may be indicative of malware related traffic
  • Performs some HTTP requests
  • Looks up the external IP address
  • Uses Windows utilities for basic functionality
  • Detects Sandboxie through the presence of a library
  • Detects Avast Antivirus through the presence of a library
  • Deletes its original binary from disk
  • Executed a process and injected code into it, probably while unpacking
  • Forces a created process to be the child of an unrelated process
  • Queries information on disks, possibly for anti-virtualization
  • Checks for the presence of known windows from debuggers and forensic tools
  • A process attempted to delay the analysis task by a long amount of time.
  • Creates or sets a registry key to a long series of bytes, possibly to store a binary or malware config
  • Steals private information from local Internet browsers
  • Mimics the file times of a Windows system file
  • Network activity contains more than one unique useragent.
  • Checks the version of Bios, possibly for anti-virtualization
  • Detects VirtualBox through the presence of a registry key
  • Attempts to modify proxy settings
  • Attempts to disable Windows Defender
  • Attempts to create or modify system certificates
  • Collects information to fingerprint the system

Related domains:

sokiran.xyz
ipinfo.io
ip-api.com
www.facebook.com
flamkravmaga.com
freeprivacytoolsforyou.xyz
www.quickfastfuriousloaded.com
cdn.discordapp.com
jom.diregame.live
superstationcity.com
sergeevih43.tumblr.com
ocsp.digicert.com
iplis.ru
apps.identrust.com
ocsp.comodoca.com
ocsp.usertrust.com
crl.usertrust.com
email.yg9.me
ocsp.sectigo.com
ocsp.verisign.com
iw.gamegame.info
ol.gamegame.info

How to determine Malware.AI.4261039841?


File Info:

crc32: 48A60432
md5: e60c6622b2dae07de65b938e203ce0e4
name: E60C6622B2DAE07DE65B938E203CE0E4.mlw
sha1: 5631fb819560bfb4164347e50ac8744752f78949
sha256: ae29526b173b1142f21ed600d821be3b6d19ab9fad87884e015583f838881337
sha512: ea659fd49b19efdc18eb87971b174ffdbd961f5519ed0963b49acc7bf37c993fcba6be8ddf63184c3e23aa2521d0d8018c253268317615e8e5946002049505be
ssdeep: 98304:x018QUjmzjPEaVF8SDZNbyEUXVj4CvLUBsKANFpal:xk8QUjecaVRDZNGNjlLUCKiXal
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

LegalCopyright: Copyright (c) 1999-2018 Igor Pavlov
InternalName: 7zS.sfx
FileVersion: 19.00
CompanyName: Igor Pavlov
ProductName: 7-Zip
ProductVersion: 19.00
FileDescription: 7z Setup SFX
OriginalFilename: 7zS.sfx.exe
Translation: 0x0409 0x04b0

Malware.AI.4261039841 also known as:

K7AntiVirusRiskware ( 0040eff71 )
DrWebTrojan.Inject4.12781
CynetMalicious (score: 99)
CAT-QuickHealPUA.IgenericRI.S15903427
ALYacGen:Variant.Graftor.959782
CylanceUnsafe
K7GWRiskware ( 0040eff71 )
Cybereasonmalicious.2b2dae
CyrenW32/CookieStealer.E.gen!Eldorado
ESET-NOD32multiple detections
APEXMalicious
AvastWin32:DropperX-gen [Drp]
ClamAVWin.Packed.Barys-9859531-0
KasperskyUDS:DangerousObject.Multi.Generic
BitDefenderTrojan.GenericKD.37122265
NANO-AntivirusRiskware.Win32.PSWTool.hqsnsl
MicroWorld-eScanTrojan.GenericKD.37122265
SophosGeneric PUA II (PUA)
BitDefenderThetaGen:NN.ZexaF.34758.vu0@aCBrzniI
VIPRETrojan.Win32.Generic!BT
TrendMicroTROJ_GEN.R002C0WFL21
McAfee-GW-EditionRDN/Generic.com
FireEyeTrojan.GenericKD.37122265
EmsisoftTrojan.GenericKD.37122265 (B)
JiangminTrojanDownloader.Adload.aclk
AviraTR/AD.Inject.jwrep
eGambitUnsafe.AI_Score_98%
Antiy-AVLTrojan/Generic.ASMalwS.2FFCE3E
KingsoftWin32.PSWTroj.Undef.(kcloud)
MicrosoftTrojan:Win32/CookiesStealer.OE!MTB
GDataGen:Variant.Graftor.959782
MAXmalware (ai score=84)
VBA32TrojanDownloader.Zenlod
MalwarebytesMalware.AI.4261039841
TrendMicro-HouseCallTROJ_GEN.R002C0WFL21
RisingTrojan.Kryptik/MSIL!1.D775 (CLASSIC:kDOURKLxuDROf70B4QqLDQ)
IkarusTrojan.Inject
FortinetW32/PossibleThreat
AVGWin32:DropperX-gen [Drp]

How to remove Malware.AI.4261039841?

Malware.AI.4261039841 removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment