Malware

Malware.AI.824200921 (file analysis)

Malware Removal

The Malware.AI.824200921 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Malware.AI.824200921 virus can do?

  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid
  • Binary compilation timestomping detected

How to determine Malware.AI.824200921?


File Info:

name: C75A0F961A9FD6566A9C.mlw
path: /opt/CAPEv2/storage/binaries/1b779542ae7e1d42fa195527cb9e9e6cbabe6a0b4b46fc2027d06949ece4f0c1
crc32: 87716779
md5: c75a0f961a9fd6566a9c48cc678614c1
sha1: df84d1d393ce382b29df4a626a25e6381d2ff6b2
sha256: 1b779542ae7e1d42fa195527cb9e9e6cbabe6a0b4b46fc2027d06949ece4f0c1
sha512: 4f4d4fb607f7bfcd885a31d16e98ca12ffb7322ae0868fc3700fbe1a2ab8b76e473c6bc03d420c33921520bca0949d2799334e51b36c973a1d3d6850768be75c
ssdeep: 12288:/ROTFvDFEEJNlTonx/RhBPhol4DYmmBmvOLyC:/YQKlTcx/pJSqXTmLy
type: PE32 executable (console) Intel 80386, for MS Windows
tlsh: T1A3946B78E61C34CCD42FAE3834D9BD97D9A4337C33169416ACEB18990EACB9A4374947
sha3_384: ba6bf67e86e8fff2f3f8989de9694f55bb88b6a1c517773c3dd08c35d550899a6a1f1bf74e2ab24ab32ca983c4f9a24d
ep_bytes: 5150528d0d18000000648b0101c801c8
timestamp: 2069-12-15 03:23:35

Version Info:

CompanyName: Microsoft Corporation
FileDescription: x86 Performance Counter Host
FileVersion: 10.0.17134.1 (WinBuild.160101.0800)
InternalName: perfhost.exe
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFilename: perfhost.exe
ProductName: Microsoft® Windows® Operating System
ProductVersion: 10.0.17134.1
Translation: 0x0409 0x04b0

Malware.AI.824200921 also known as:

Elasticmalicious (high confidence)
MicroWorld-eScanWin32.Expiro.Gen.6
FireEyeGeneric.mg.c75a0f961a9fd656
ALYacWin32.Expiro.Gen.6
CylanceUnsafe
Cybereasonmalicious.61a9fd
VirITWin32.Expiro.CV
CyrenW32/Expiro.AN.gen!Eldorado
SymantecML.Attribute.HighConfidence
ESET-NOD32a variant of Win32/Expiro.NDG
APEXMalicious
ClamAVWin.Malware.Expiro-9919545-0
KasperskyHEUR:Trojan.Win32.Expiro.gen
BitDefenderWin32.Expiro.Gen.6
NANO-AntivirusVirus.Win32.Gen.ccmw
AvastWin32:Xpirat-C [Inf]
Ad-AwareWin32.Expiro.Gen.6
EmsisoftWin32.Expiro.Gen.6 (B)
DrWebWin32.Expiro.150
TrendMicroVirus.Win32.EXPIRO.AD
SophosML/PE-A + Mal/EncPk-MK
SentinelOneStatic AI – Malicious PE
GDataWin32.Expiro.Gen.6
JiangminTrojan.PSW.Stealer.abj
AviraTR/Patched.Gen
Antiy-AVLTrojan/Generic.ASVirus.315
MicrosoftTrojan:Win32/Raccoon.EC!MTB
CynetMalicious (score: 100)
Acronissuspicious
MAXmalware (ai score=85)
VBA32BScope.Trojan.Wacatac
MalwarebytesMalware.AI.824200921
TrendMicro-HouseCallVirus.Win32.EXPIRO.AD
IkarusVirus.Win32.Expiro
FortinetW32/Expiro.NDG
AVGWin32:Xpirat-C [Inf]
PandaTrj/Genetic.gen
CrowdStrikewin/malicious_confidence_80% (D)

How to remove Malware.AI.824200921?

Malware.AI.824200921 removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment