Malware

Should I remove “Malware.AI.743594625”?

Malware Removal

The Malware.AI.743594625 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Malware.AI.743594625 virus can do?

  • Sample contains Overlay data
  • Performs HTTP requests potentially not found in PCAP.
  • Reads data out of its own binary image
  • Drops a binary and executes it
  • The binary contains an unknown PE section name indicative of packing
  • Authenticode signature is invalid
  • Attempts to modify proxy settings
  • Creates a copy of itself

How to determine Malware.AI.743594625?


File Info:

name: 406978398F242F9B5635.mlw
path: /opt/CAPEv2/storage/binaries/631706d165dac06cd25c6daa647e34f3bc622a9cc322d16069b19b85b552ae6c
crc32: 5B65F69A
md5: 406978398f242f9b563591d219a4cfc2
sha1: fb647a676d8ac1481c9930bd3b12accc12e7959c
sha256: 631706d165dac06cd25c6daa647e34f3bc622a9cc322d16069b19b85b552ae6c
sha512: 12c5c2090b8e1142e10a03ad3a556f95bf26c556e9d520dc315624d7df3bded15f8096df69748f5fa278306c27d243538ba90b74468a2d1326b2358cd80d7ad2
ssdeep: 12288:RzNB0JfiwSdYSui8zZH94I3H1v1REWRYdlHkLhmvqnqamlTwQA2hGnbYNjDnYqn7:dNsfiTdYSuVzZH9tH1v1uybiHYqnSI
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1ADE47C316560D032E6F10273A92C96302D2CAF3C175489AAE7C2BE1D7AB45856FF725F
sha3_384: 1c01d2cf4e91cfaf61d62f1662f0d26d4001fff378691ee2f58c17017ff409e3e77abfafe1fcc451de1657a982adf76a
ep_bytes: e83a050000e97afeffffcccccccccc8b
timestamp: 2019-09-17 05:33:38

Version Info:

CompanyName: Sigma Software
FileDescription: NetShield Kit 1.3.28.0
FileVersion: 1.3.28.0
InternalName: setup
LegalCopyright: 2020 (c) Sigma Software
OriginalFilename: nsk-win32-bundle.exe
ProductName: NetShield Kit 1.3.28.0
ProductVersion: 1.3.28.0
Translation: 0x0409 0x04e4

Malware.AI.743594625 also known as:

LionicTrojan.Win32.Agent.b!c
MicroWorld-eScanTrojan.GenericKD.50294372
ClamAVWin.Malware.Agentb-9876963-0
FireEyeTrojan.GenericKD.50294372
ALYacTrojan.GenericKD.50294372
MalwarebytesMalware.AI.743594625
SangforDropper.Win32.Agent.V4wp
AlibabaTrojanDropper:Win32/Generic.c8af9a7f
CyrenW32/Agent.DHL.gen!Eldorado
SymantecTrojan.Gen.MBT
Elasticmalicious (high confidence)
ESET-NOD32a variant of Generik.IZHWNLN
Paloaltogeneric.ml
CynetMalicious (score: 99)
KasperskyTrojan-Dropper.Win32.Agent.tetdjj
BitDefenderTrojan.GenericKD.50294372
SUPERAntiSpywareTrojan.Agent/GenericKD
AvastWin32:Malware-gen
TencentWin32.Trojan-Dropper.Agent.Pgil
EmsisoftTrojan.GenericKD.50294372 (B)
F-SecureTrojan.TR/Drop.Agent.gldij
VIPRETrojan.GenericKD.50294372
McAfee-GW-EditionRDN/Generic Dropper
SophosMal/Generic-S
IkarusTrojan.Dropper.Agent
GDataTrojan.GenericKD.50294372
AviraTR/Drop.Agent.gldij
ArcabitTrojan.Generic.D2FF6E64
ZoneAlarmTrojan-Dropper.Win32.Agent.tetdjj
MicrosoftTrojan:Win32/Wacatac.B!ml
GoogleDetected
AhnLab-V3Trojan/Win.Dropper.C5158540
McAfeeRDN/Generic Dropper
MAXmalware (ai score=89)
Cylanceunsafe
PandaTrj/CI.A
MaxSecureTrojan.Malware.300983.susgen
FortinetW32/AgentTB.KIJC!tr
AVGWin32:Malware-gen
DeepInstinctMALICIOUS

How to remove Malware.AI.743594625?

Malware.AI.743594625 removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment