ML/PE-A + Mal/Quasar-E removal

The ML/PE-A + Mal/Quasar-E is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What ML/PE-A + Mal/Quasar-E virus can do?

Dynamic (imported) function loading detected
Authenticode signature is invalid
CAPE detected the QuasarStealer malware family

How to determine ML/PE-A + Mal/Quasar-E?


File Info:
name: C0656E5CB8A64DF01C8D.mlw
path: /opt/CAPEv2/storage/binaries/1fd87316d8ce63c23dcb4b4bb18228b1905afce4c2978d946dd5a5696ea9570f
crc32: 30583AC7
md5: c0656e5cb8a64df01c8da75198da9ade
sha1: a1ec9a81b0b5e072ebbf450aca2a18380d87d1d9
sha256: 1fd87316d8ce63c23dcb4b4bb18228b1905afce4c2978d946dd5a5696ea9570f
sha512: 62f20136bae56839eaec3247b1f53eb83565858b8568278fe4814af400bfdb74740015d780939d95981ef1ae5ee01e2e561b0827824063afa310d95ba8fd8e75
ssdeep: 6144:UTEgdc0YBebGbXOsA6j1RdhxnABmq/TxT5EtqH+yw4MUcEJOb8F9+t9YmcMTIcTY:UTEgdfYZA6VABdi4eywGZpyjcMTIcd6
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T15CB45B8123FCC52BE1AE57BDE8B104216BF5F407A6A7EB4F4940A1E92C567429E407F3
sha3_384: 2191d3b2b5333acc9aecdce647700d68e58d2a8efcdf5796a5caa72523baa4eae9a857a0895017e29f4abf681a5abad8
ep_bytes: ff250020400000000000000000000000
timestamp: 2020-06-05 15:59:49

Version Info:
Translation: 0x0000 0x04b0
Comments: 
CompanyName: Microsoft Company
FileDescription: Pdf
FileVersion: 1.0.0.0
InternalName: aracvebilgileridask.pdf
LegalCopyright: Microsoft 2022©
LegalTrademarks: Microsoft
OriginalFilename: aracvebilgileridask.pdf
ProductName: aracvebilgileridask.pdf
ProductVersion: 1.0.0.0
Assembly Version: 1.0.0.0

ML/PE-A + Mal/Quasar-E also known as:

Bkav	W32.AIDetectNet.01
Elastic	malicious (high confidence)
MicroWorld-eScan	IL:Trojan.MSILMamut.13
FireEye	Generic.mg.c0656e5cb8a64df0
CAT-QuickHeal	Trojan.MsilFC.S15413537
ALYac	IL:Trojan.MSILMamut.13
Cylance	Unsafe
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Trojan ( 0056b6611 )
K7GW	Trojan ( 0056b6611 )
Cybereason	malicious.cb8a64
BitDefenderTheta	Gen:NN.ZemsilF.34712.Fm0@aafkdMj
VirIT	Trojan.Win32.MulDrop13.PUA
Cyren	W32/MSIL_Troj.BTX.gen!Eldorado
ESET-NOD32	a variant of MSIL/Agent.BPH
TrendMicro-HouseCall	TSPY_TINCLEX.SM1
ClamAV	Win.Malware.Generic-9883082-0
Kaspersky	HEUR:Trojan.MSIL.Quasar.gen
BitDefender	IL:Trojan.MSILMamut.13
Avast	MSIL:Quasar-A [Rat]
Tencent	Trojan.Msil.Quasar.wa
Ad-Aware	IL:Trojan.MSILMamut.13
Emsisoft	IL:Trojan.MSILMamut.13 (B)
DrWeb	Trojan.MulDrop13.10660
TrendMicro	TSPY_TINCLEX.SM1
McAfee-GW-Edition	BehavesLike.Win32.Generic.hh
SentinelOne	Static AI – Malicious PE
Sophos	ML/PE-A + Mal/Quasar-E
APEX	Malicious
GData	MSIL.Backdoor.Quasar.B
Jiangmin	Trojan.MSIL.oyqd
Avira	HEUR/AGEN.1235885
MAX	malware (ai score=86)
Arcabit	IL:Trojan.MSILMamut.13
Microsoft	Backdoor:MSIL/Quasar.GG!MTB
Cynet	Malicious (score: 100)
AhnLab-V3	Backdoor/Win32.QuasarRAT.R341693
Acronis	suspicious
McAfee	PWS-FDEK!C0656E5CB8A6
TACHYON	Trojan/W32.DN-Agent.514048.K
Malwarebytes	Bladabindi.Backdoor.Njrat.DDS
Rising	Trojan.Generic/MSIL@AI.100 (RDM.MSIL:PdN+jt8rXdcYHVMlV3Nong)
Ikarus	Backdoor.Win32.Xiclog
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	MSIL/Agent.BPH!tr
AVG	MSIL:Quasar-A [Rat]
CrowdStrike	win/malicious_confidence_70% (D)

How to remove ML/PE-A + Mal/Quasar-E?

ML/PE-A + Mal/Quasar-E removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X