About “ML/PE-A + Troj/Agent-BFKK” infection

The ML/PE-A + Troj/Agent-BFKK is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What ML/PE-A + Troj/Agent-BFKK virus can do?

• Behavioural detection: Executable code extraction – unpacking
• SetUnhandledExceptionFilter detected (possible anti-debug)
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Dynamic (imported) function loading detected
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• The binary contains an unknown PE section name indicative of packing
• Executable file is packed/obfuscated with MPRESS
• Authenticode signature is invalid
• Collects and encrypts information about the computer likely to send to C2 server
• Collects information to fingerprint the system
• Anomalous binary characteristics

How to determine ML/PE-A + Troj/Agent-BFKK?

File Info:
name: 190133A67491C11D2688.mlw
path: /opt/CAPEv2/storage/binaries/3cc537c8d1a1e9f934a8b169696d062f465bf66b137ff03909a4d17fd6651ece
crc32: 29150D3A
md5: 190133a67491c11d26886fda9f8fee22
sha1: eb28a0f3a1c58d89efdeda592a46697b60442218
sha256: 3cc537c8d1a1e9f934a8b169696d062f465bf66b137ff03909a4d17fd6651ece
sha512: 09bf743fd7fd46f2d1b7612c863678809b74d43daf1c6bdb0eda5f2bc7909c50da063b9167d48380db022f475c4dcefaf33329b3107fa74f6aa8c3a03e37da32
ssdeep: 3072:2CMiqJl3v1S4AsvdhxBz8bNk/AKItB/pL/s9hlSLUFWzN:2CMzfM4vxBIO+XpDnUUzN
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1C0E3CF8AC1007406E4D60DB53529EB25C777BAC91F1B8759760CA1F2EDBBF026F2634A
sha3_384: 24b011b9e15602470283fdb526b527c57933c6bcbb6a0d13ee6a150502a3e6813b2a0baef55a77efa298d9ba3177d938
ep_bytes: 64a1000000005589e56aff681c304000
timestamp: 2013-04-28 05:45:33

Version Info:
0: [No Data]

ML/PE-A + Troj/Agent-BFKK also known as:

How to remove ML/PE-A + Troj/Agent-BFKK?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.