Categories: Malware

ML/PE-A + Mal/MSIL-AZ removal

The ML/PE-A + Mal/MSIL-AZ is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What ML/PE-A + Mal/MSIL-AZ virus can do?

SetUnhandledExceptionFilter detected (possible anti-debug)
Attempts to connect to a dead IP:Port (1 unique times)
Creates RWX memory
Guard pages use detected – possible anti-debugging.
A process attempted to delay the analysis task.
Dynamic (imported) function loading detected
CAPE extracted potentially suspicious content
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
Collects and encrypts information about the computer likely to send to C2 server

How to determine ML/PE-A + Mal/MSIL-AZ?


File Info:
name: 260F624F14BE8F5D8C7E.mlwpath: /opt/CAPEv2/storage/binaries/f231dabcdb5d6aed764714a8c03e1e4d1bf2d78c1aae3a9c5b3b3333b9dbcee4crc32: EE52826Amd5: 260f624f14be8f5d8c7eb619da1bf907sha1: df90193de3307a72238dedde0ec6399e8f7d9067sha256: f231dabcdb5d6aed764714a8c03e1e4d1bf2d78c1aae3a9c5b3b3333b9dbcee4sha512: a62561c0b0a197a2ce999e20cf3e03991edb51984eab2e4c5340f5b52fa3c91dce829e2e16b806bf9cc14f3da8ca1dd696247b58b610daa1200f36b771f00fe9ssdeep: 24576:HzsY4mLd78bcL/p8QevR7HUFoubFtv1ct74zHRiPI17N5:H178UWLHVuhxzxiPI1type: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1B755125E73DE4D11E8BE83FD90B28644C6B1E25A956BDF0C0D8D90A81E27794CD10BBBsha3_384: 753d23a778e227bc8da03743855a53a7f21b36c6ae267ce5ceca7ff22405f62c72a4a9d6b90cc7db1420e914b42b46a4ep_bytes: ff250020400000000000000000000000timestamp: 2017-10-13 15:07:45
Version Info:
0: [No Data]

ML/PE-A + Mal/MSIL-AZ also known as:

Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Ransom.Generic.1
ClamAV	Win.Packed.Zyklon-9872988-0
CAT-QuickHeal	Trojan.GenericFC.S18883569
McAfee	GenericRXBG-CS!260F624F14BE
Cylance	Unsafe
Zillya	Trojan.Zyklon.Win32.65
Sangfor	Backdoor.Win32.Omaneat.8
K7AntiVirus	Trojan ( 700000121 )
Alibaba	Backdoor:MSIL/Omaneat.b516af43
K7GW	Trojan ( 700000121 )
CrowdStrike	win/malicious_confidence_100% (W)
Symantec	Trojan.Klonzyrat
ESET-NOD32	a variant of MSIL/Zyklon.C
APEX	Malicious
Paloalto	generic.ml
Cynet	Malicious (score: 99)
Kaspersky	HEUR:Trojan.Win32.Generic
BitDefender	Gen:Variant.Ransom.Generic.1
NANO-Antivirus	Trojan.Win32.Zyklon.etypsg
Avast	MSIL:Agent-DRV [Trj]
Rising	Backdoor.Zyklon!1.CB43 (CLASSIC)
Ad-Aware	Gen:Variant.Ransom.Generic.1
Sophos	ML/PE-A + Mal/MSIL-AZ
F-Secure	Trojan.TR/Dropper.Gen
DrWeb	Trojan.DownLoader23.50673
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TROJ_GEN.R002C0DGO21
McAfee-GW-Edition	BehavesLike.Win32.Generic.tc
FireEye	Generic.mg.260f624f14be8f5d
Emsisoft	Gen:Variant.Ransom.Generic.1 (B)
Ikarus	Trojan.MSIL.Zyklon
GData	MSIL.Trojan.Zyklon.A
Jiangmin	Trojan.Generic.apsut
Avira	TR/Dropper.Gen
Antiy-AVL	Trojan/Generic.ASMalwS.1E93B9D
Arcabit	Trojan.Ransom.Generic.1
Microsoft	Backdoor:MSIL/Omaneat.B
AhnLab-V3	Trojan/Win32.Skeeyah.R194230
ALYac	Gen:Variant.Ransom.Generic.1
MAX	malware (ai score=96)
VBA32	TScope.Trojan.MSIL
Malwarebytes	Backdoor.Zyklon
TrendMicro-HouseCall	TROJ_GEN.R002C0DGO21
Tencent	Win32.Trojan.Generic.Hoex
Yandex	Trojan.Kryptik!WnpPvuJ505Q
SentinelOne	Static AI – Malicious PE
eGambit	Unsafe.AI_Score_100%
Fortinet	MSIL/Generic.AP.57260!tr
BitDefenderTheta	Gen:NN.ZemsilF.34294.rnW@aaSEZBf
AVG	MSIL:Agent-DRV [Trj]
Panda	Trj/GdSda.A
MaxSecure	Trojan.Malware.300983.susgen