What is “ML/PE-A + Mal/EncPk-TG”?

The ML/PE-A + Mal/EncPk-TG is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What ML/PE-A + Mal/EncPk-TG virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Anomalous file deletion behavior detected (10+)
• Dynamic (imported) function loading detected
• At least one IP Address, Domain, or File Name was found in a crypto call
• Enumerates running processes
• Expresses interest in specific running processes
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Unconventionial language used in binary resources: Russian
• The binary contains an unknown PE section name indicative of packing
• Authenticode signature is invalid
• Code injection with CreateRemoteThread in a remote process
• Behavioural detection: Injection (inter-process)
• Behavioural detection: Injection with CreateRemoteThread in a remote process
• Tries to unhook or modify Windows functions monitored by Cuckoo
• Steals private information from local Internet browsers
• Collects and encrypts information about the computer likely to send to C2 server
• Attempts to modify browser security settings
• Harvests credentials from local FTP client softwares
• Collects information to fingerprint the system
• Anomalous binary characteristics
• Clears web history

How to determine ML/PE-A + Mal/EncPk-TG?

File Info:
name: 95B0AF46686EE6C134F6.mlw
path: /opt/CAPEv2/storage/binaries/38d29c34c4f92554eefdc012b249889b162d18d48b0977d235a3993b0df7cc3a
crc32: 6BF2B0ED
md5: 95b0af46686ee6c134f6c734503b6dee
sha1: 8a594bbd1a20c2882eac44f70a5422635aadfa9f
sha256: 38d29c34c4f92554eefdc012b249889b162d18d48b0977d235a3993b0df7cc3a
sha512: 18d2b7eee1c6285419bdbad888d420445e4084edd6f83ee138b18a6e081c1c773b4b088ff771a6ab6d52b69189d786a2100637183d83f18c2aecc7aeed495567
ssdeep: 768:KU0Dm/QES+c3blYRCmFL0VcWmbV4KLw5Y/pJtDv8p9JS4tFs/v55:br/k3blmiVfm54q98pvS6Fs3H
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T156C3F17328F13866D9EB297396931074EE31A617B3C58999F099D32A8F7A74B9C0F404
sha3_384: 9826264077ab1270ee26cda8ebb751462140e61780dbbb2c6938ab2f1147ad1d75190608a29eb92766726a3155eee7e4
ep_bytes: 660fbec18db424cd502c8c64a1300000
timestamp: 2005-04-06 20:06:58

Version Info:
CompanyName: †SOFTWINࢗ栍뢟㼇鎘
뇡娻얪㜳쟖豙鶻udc19暕ꊈuddc4व槻綃⵫udcc7瘵犋斷ຜ끷ퟨ쾷밸Č镃俏트픳挔졑곚ℚ쯊᧤攅ꄷꏚ⋗㶿捓뾬࿓◚᥍笌촣ᆍ蠳棇嬆臱萟ᄅᛮ蟠ꎈ㸄人흛랁䡖쟤뚒睆uda3e凞㠊蔵텘ⶋ⍾丼暮聩漱㻑쫨ᗑ㣚뮥⟲䝙漇⺒뼕긓잂gꈬῶ짮얡웃䤵△鸖愮볉잙᱕蜐ᎍ窹㳚伭㘈ᶺ氐隙ꠟ扞ꔝ䔥⥝醉⼦官삯粋明撑ꍇ쑦㔼竼扅팛虏젔焟芪례˷꘧猤鵘滒ᕷঃ䦫蝷Č꯫좪ud88c⹐킝鶸㇥빶ꉖudf56펯氼샐udf6c㠽׏붼㲊蕏惠䝕䀂ͣᅄᗋ휘恦ꗓ孃뱻漮뛵끿耱揟ᔏ틩㸘揙콍ﺬ⎛♯싃媎趹ꍰ샗枦땙펂䀃远繍ꇜ뤻幵᭮ո綬뽉ꤒῡudeb5ₜ촪뻳鿬ꕋۮॆ殿膯㌞날戨ᧁⱮ휁냞udf03銢퓛ῆ⣵蘿蘳㍃벖❕ﵱᲐ뉃쯻᳋ꖎ獐ᴫℍ셄ଽळ餷똘煈沄ᑋ逆ude1c顠迹⾼贺㔆㼼浸敶獲潩㵮ㄢ〮•湥潣楤杮∽呕ⵆ∸猠慴摮污湯㵥礢獥㼢ാ㰊獡敳扭祬砠汭獮∽牵㩮捳敨慭⵳業牣獯景⵴潣㩭獡⹭ㅶ•慭楮敦瑳敖獲潩㵮ㄢ〮㸢਍†愼獳浥汢䥹敤瑮瑩൹ ††瘠牥楳湯∽⸱⸰⸰∰਍†††牰捯獥潳䅲捲楨整瑣牵㵥堢㘸ഢ ††渠浡㵥䴢物湡慤䴮物湡慤䴮物湡慤ഢ ††琠灹㵥眢湩㈳ഢ ⼠ാ 㰠敤捳楲瑰潩㹮楍慲摮㱡搯獥牣灩楴湯ാ 㰠牴獵䥴普浸湬㵳產湲猺档浥獡洭捩潲潳瑦挭浯愺浳瘮∲ാ †㰠敳畣楲祴ാ ††㰠敲畱獥整偤楲楶敬敧㹳਍††††爼煥敵瑳摥硅捥瑵潩䱮癥汥਍†††††敬敶㵬愢䥳癮歯牥ഢ ††††甠䅩捣獥㵳昢污敳⼢ാ ††㰠爯煥敵瑳摥牐癩汩来獥ാ †㰠猯捥牵瑩㹹਍†⼼牴獵䥴普㹯਍†搼灥湥敤据㹹਍††搼灥湥敤瑮獁敳扭祬ാ †††㰠獡敳扭祬摉湥楴祴਍††††††祴数∽楷㍮∲਍††††††慮敭∽楍牣獯景⹴楗摮睯⹳潃浭湯䌭湯牴汯≳਍††††††敶獲潩㵮㘢〮〮〮ഢ †††††瀠潲散獳牯牁档瑩捥畴敲∽㡘∶਍††††††異汢捩敋呹歯湥∽㔶㔹㙢ㄴ㐴捣ㅦ晤ഢ †††††氠湡畧条㵥⨢ഢ †††⼠ാ †㰠搯灥湥敤瑮獁敳扭祬ാ 㰠搯灥湥敤据㹹਍†搼灥湥敤据㹹਍††搼灥湥敤瑮獁敳扭祬ാ †††㰠獡敳扭祬摉湥楴祴਍††††††祴数∽楷㍮∲਍††††††慮敭∽楍牣獯景⹴楗摮睯⹳摇灩畬≳਍††††††敶獲潩㵮ㄢ〮〮〮ഢ †††††瀠潲散獳牯牁档瑩捥畴敲∽㡘∶਍††††††異汢捩敋呹歯湥∽㔶㔹㙢ㄴ㐴捣ㅦ晤ഢ †††††氠湡畧条㵥⨢ഢ †††⼠ാ †㰠搯灥湥敤瑮獁敳扭祬ാ 㰠搯灥湥敤据㹹਍†挼浯慰楴楢楬祴砠汭獮∽牵㩮捳敨慭⵳業牣獯景⵴潣㩭潣灭瑡扩汩瑩⹹ㅶ㸢਍††愼灰楬慣楴湯ാ ††㰠畳灰牯整佤⁓摉∽㍻ㄵ㠳㥢ⵡ搵㘹㐭扦ⵤ攸搲愭㐲〴㈲昵㌹絡⼢ാ †㰠愯灰楬慣楴湯ാ 㰠振浯慰楴楢楬祴ാ㰊愯獳浥汢㹹਍: 

ML/PE-A + Mal/EncPk-TG also known as:

How to remove ML/PE-A + Mal/EncPk-TG?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.