Malware

How to remove “Malware.AI.4288803039”?

Malware Removal

The Malware.AI.4288803039 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Malware.AI.4288803039 virus can do?

  • SetUnhandledExceptionFilter detected (possible anti-debug)
  • Yara rule detections observed from a process memory dump/dropped files/CAPE
  • Dynamic (imported) function loading detected
  • Reads data out of its own binary image
  • Drops a binary and executes it
  • Authenticode signature is invalid
  • Created a process from a suspicious location
  • Anomalous binary characteristics

How to determine Malware.AI.4288803039?


File Info:

name: E056476D87E7B8FC60FF.mlw
path: /opt/CAPEv2/storage/binaries/fa61b8765f1eaa1d089029d01a08cb9e7f511783e41dcd74170a1cb28086c3dd
crc32: 19ADE157
md5: e056476d87e7b8fc60ff34c7f13b4c5a
sha1: 48031e9ee453a5968e7e6cb048cd5771544c13c9
sha256: fa61b8765f1eaa1d089029d01a08cb9e7f511783e41dcd74170a1cb28086c3dd
sha512: 79970627d21d571f6da421dd2194d2e50ac7d1eeed2490c192c5228a01d62fccbb4c6dc2ed6d8103a17d08f5d5e2df6e6caffc7d6f78f3b5c4c6be9a99615789
ssdeep: 24576:P33/TOMs8RVFXqKLDVad7jbvu/8kv1bH5xp6ty5thBvJWTg+s1sm:P3LW8RVtcdjvuEk5H5xp8yThXWTg+s1X
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T18B752346A92199F1F5AD00B684235B60DB3BBE369DF847131FD87607EE356930A33E09
sha3_384: e91e41b43f5fa07e9f54d940f342f509ed6676428567f8ff8755dab77d77419cbfdb171aa15e9184945edfb140b2a163
ep_bytes: e8fb2e0000e916feffff558bec83ec04
timestamp: 2010-06-22 13:31:07

Version Info:

Comments: Created with Setup Factory 8.0
FileDescription: Setup Application
FileVersion: 8.2.2.0
InternalName: suf80_launch
LegalCopyright: Setup Engine Copyright © 2004-2010 Indigo Rose Corporation
LegalTrademarks: Setup Factory is a trademark of Indigo Rose Corporation.
OriginalFilename: suf80_launch.exe
ProductName: Setup Factory 8.0 Runtime
ProductVersion: 8.2.2.0
Translation: 0x0409 0x04e4

Malware.AI.4288803039 also known as:

LionicTrojan.Win32.CryFile.j!c
MicroWorld-eScanTrojan.RansomKD.5631067
FireEyeTrojan.RansomKD.5631067
ALYacTrojan.RansomKD.5631067
CylanceUnsafe
SangforTrojan.Win32.Gen.2
AlibabaRansom:Win32/CryFile.e0ed5b8a
Cybereasonmalicious.d87e7b
SymantecTrojan.Gen.2
TrendMicro-HouseCallTROJ_GEN.R002H09B222
KasperskyTrojan-Ransom.Win32.CryFile.xgt
BitDefenderTrojan.RansomKD.5631067
AvastWin32:Malware-gen
TencentWin32.Trojan.Cryfile.Ahec
McAfee-GW-EditionBehavesLike.Win32.Dropper.tc
EmsisoftTrojan.RansomKD.5631067 (B)
IkarusTrojan-RansomKD
WebrootW32.CryFile
AviraTR/CryFile.fdxlt
MicrosoftTrojan:Win32/Wacatac.B!ml
GDataTrojan.RansomKD.5631067
McAfeeArtemis!E056476D87E7
MAXmalware (ai score=85)
VBA32TrojanRansom.CryFile
MalwarebytesMalware.AI.4288803039
APEXMalicious
RisingRansom.CryFile!8.20D (CLOUD)
AVGWin32:Malware-gen

How to remove Malware.AI.4288803039?

Malware.AI.4288803039 removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment