Malware

About “Malware.AI.794522379” infection

Malware Removal

The Malware.AI.794522379 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Malware.AI.794522379 virus can do?

  • Behavioural detection: Executable code extraction – unpacking
  • Sample contains Overlay data
  • Reads data out of its own binary image
  • CAPE extracted potentially suspicious content
  • Authenticode signature is invalid
  • Behavioural detection: Injection (Process Hollowing)
  • Behavioural detection: Injection (inter-process)
  • Installs itself for autorun at Windows startup
  • CAPE detected the HawkEyev9 malware family
  • Anomalous binary characteristics
  • Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Malware.AI.794522379?


File Info:

name: 2D94A0980C7E655ACFE6.mlw
path: /opt/CAPEv2/storage/binaries/05ce6f8c428559c0b026aee72ab8fc3e0759867c954b0338e81b0979eb2c9c8e
crc32: 3DC964FE
md5: 2d94a0980c7e655acfe6072a96a0aa7d
sha1: ee1c584c2722bebd311f524ec10bcb35f7164f17
sha256: 05ce6f8c428559c0b026aee72ab8fc3e0759867c954b0338e81b0979eb2c9c8e
sha512: ff224b759477390520babb0eb8382e0079c5f31ad18b0bc6ee39e0098fa6b08ff85e8f0d0ae10a7cb45b5a758921cdb11a761b9d606ab33dd0f91890f4a2f912
ssdeep: 24576:WCdxte/80jYLT3U1jfsWa9L+0aVsXJoWGhq5h1/qKp6hpKNEhQy:fw80cTsjkWa9ty06Ory
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T16FA5D0D6A3AD81E1CD1576F2BE1427836F7A59324A3070193F9A2D5C9E630B2412DFB3
sha3_384: 94d1c1f3fbaf801367a5bc45ed5adff6bbb47fb0b78b1da14b73e83e09256506b8637444745d4219d47b49188aa6f634
ep_bytes: e8b8d00000e97ffeffffcccccccccccc
timestamp: 2019-04-04 22:47:52

Version Info:

Translation: 0x0809 0x04b0

Malware.AI.794522379 also known as:

BkavW32.AIDetectNet.01
tehtrisGeneric.Malware
MicroWorld-eScanTrojan.GenericKD.65474466
FireEyeGeneric.mg.2d94a0980c7e655a
ALYacTrojan.GenericKD.65474466
Cylanceunsafe
SangforVirus.Win32.Save.a
CrowdStrikewin/malicious_confidence_100% (D)
K7GWTrojan ( 0054b4211 )
K7AntiVirusTrojan ( 0054b4211 )
CyrenW32/AutoIt.IJ.gen!Eldorado
SymantecAUT.Heuristic!gen5
Elasticmalicious (high confidence)
ESET-NOD32a variant of Win32/Injector.Autoit.DWA
APEXMalicious
ClamAVWin.Malware.Autoit-6956866-0
KasperskyHEUR:Trojan.Win32.Generic
BitDefenderTrojan.GenericKD.65474466
AvastWin32:Trojan-gen
SophosMal/AuItInj-A
DrWebTrojan.AutoIt.372
VIPRETrojan.GenericKD.65474466
TrendMicroTrojan.AutoIt.CRYPTINJECT.SMA
McAfee-GW-EditionBehavesLike.Win32.TrojanAitInject.vh
EmsisoftTrojan.GenericKD.65474466 (B)
IkarusTrojan.Autoit
GDataTrojan.GenericKD.65474466
GoogleDetected
AviraHEUR/AGEN.1245501
Antiy-AVLGrayWare/Autoit.BinToStr.a
ArcabitTrojan.Generic.D3E70FA2
MicrosoftTrojan:Win32/Wacatac.B!ml
CynetMalicious (score: 100)
AhnLab-V3Win-Trojan/AutoInj.Exp
Acronissuspicious
McAfeeGenericR-PMT!2D94A0980C7E
MAXmalware (ai score=89)
VBA32TrojanDropper.Autit
MalwarebytesMalware.AI.794522379
TrendMicro-HouseCallTrojan.AutoIt.CRYPTINJECT.SMA
RisingTrojan.Injector/Autoit!1.BB8F (CLASSIC)
MaxSecureTrojan.Malware.300983.susgen
FortinetAutoIt/Injector.DWA!tr
BitDefenderThetaAI:Packer.D20D1E4317
AVGWin32:Trojan-gen
Cybereasonmalicious.80c7e6
PandaTrj/Genetic.gen

How to remove Malware.AI.794522379?

Malware.AI.794522379 removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment