ML/PE-A + Mal/Upatre-H removal guide

The ML/PE-A + Mal/Upatre-H is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What ML/PE-A + Mal/Upatre-H virus can do?

• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Possible date expiration check, exits too soon after checking local time
• Anomalous file deletion behavior detected (10+)
• Dynamic (imported) function loading detected
• Reads data out of its own binary image
• A process created a hidden window
• Drops a binary and executes it
• Authenticode signature is invalid
• Created a process from a suspicious location
• Anomalous binary characteristics

How to determine ML/PE-A + Mal/Upatre-H?

File Info:
name: 8E8DA07998CB802BEE73.mlw
path: /opt/CAPEv2/storage/binaries/49bd69daf91ea70eaa25e1acca09ac308a6b64a0e776916b6bfeb11a640720e5
crc32: CE1A665D
md5: 8e8da07998cb802bee73c9b0a51bea1e
sha1: bb2fddf25184e606e71965ab4cbe55c0d74477db
sha256: 49bd69daf91ea70eaa25e1acca09ac308a6b64a0e776916b6bfeb11a640720e5
sha512: 52d22291b0206fb490ed628e8e9dc4c4e32fc5d68bd96b1d11c2e3173c5457d9e935142af307ccca1d1ec4d4ea443d6debcfe3446180320a34bebf7cff360688
ssdeep: 384:ZJtxTPUyMVhN8zDkB1mhLjggggggLvggggggggS03zL:HbYps/k/mFggggggLvggggggggS03zL
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1A2A2957017C10A90E6A31E769572620DE19CBF2323436ECF1B70F6854FF17D2A932669
sha3_384: b0061b519a6907c05727d7182c059d468be7ab8c496c326cda548349127e9fc8d1f2b73d9d28f0a6b3a6fdc84e37d203
ep_bytes: 558bec6aff68a0324000680212400064
timestamp: 1994-04-22 20:19:25

Version Info:
CompanyName: Juice
FileDescription: Juice proged
FileVersion: Version 2.1.1
InternalName: Juice
LegalCopyright: Copyright by Sego© 
OriginalFilename: iJuice
Translation: 0x0409 0x04e3

ML/PE-A + Mal/Upatre-H also known as:

How to remove ML/PE-A + Mal/Upatre-H?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.