Categories: Malware

ML/PE-A + Mal/Upatre-H removal guide

The ML/PE-A + Mal/Upatre-H is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What ML/PE-A + Mal/Upatre-H virus can do?

Yara rule detections observed from a process memory dump/dropped files/CAPE
Creates RWX memory
Possible date expiration check, exits too soon after checking local time
Anomalous file deletion behavior detected (10+)
Dynamic (imported) function loading detected
Reads data out of its own binary image
A process created a hidden window
Drops a binary and executes it
Authenticode signature is invalid
Created a process from a suspicious location
Anomalous binary characteristics

How to determine ML/PE-A + Mal/Upatre-H?


File Info:
name: 8E8DA07998CB802BEE73.mlwpath: /opt/CAPEv2/storage/binaries/49bd69daf91ea70eaa25e1acca09ac308a6b64a0e776916b6bfeb11a640720e5crc32: CE1A665Dmd5: 8e8da07998cb802bee73c9b0a51bea1esha1: bb2fddf25184e606e71965ab4cbe55c0d74477dbsha256: 49bd69daf91ea70eaa25e1acca09ac308a6b64a0e776916b6bfeb11a640720e5sha512: 52d22291b0206fb490ed628e8e9dc4c4e32fc5d68bd96b1d11c2e3173c5457d9e935142af307ccca1d1ec4d4ea443d6debcfe3446180320a34bebf7cff360688ssdeep: 384:ZJtxTPUyMVhN8zDkB1mhLjggggggLvggggggggS03zL:HbYps/k/mFggggggLvggggggggS03zLtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1A2A2957017C10A90E6A31E769572620DE19CBF2323436ECF1B70F6854FF17D2A932669sha3_384: b0061b519a6907c05727d7182c059d468be7ab8c496c326cda548349127e9fc8d1f2b73d9d28f0a6b3a6fdc84e37d203ep_bytes: 558bec6aff68a0324000680212400064timestamp: 1994-04-22 20:19:25
Version Info:
CompanyName: JuiceFileDescription: Juice progedFileVersion: Version 2.1.1InternalName: JuiceLegalCopyright: Copyright by Sego© OriginalFilename: iJuiceTranslation: 0x0409 0x04e3

ML/PE-A + Mal/Upatre-H also known as:

Bkav	W32.FamVT.GeND.Trojan
MicroWorld-eScan	Trojan.Spy.Zbot.FNZ
FireEye	Generic.mg.8e8da07998cb802b
CAT-QuickHeal	TrojanDownloader.Upatre.AA4
McAfee	Downloader-FSH
Cylance	Unsafe
VIPRE	Trojan.Win32.Upatre.aa (v)
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 0001140e1 )
BitDefender	Trojan.Spy.Zbot.FNZ
K7GW	Trojan ( 0001140e1 )
Cybereason	malicious.998cb8
BitDefenderTheta	Gen:NN.ZexaF.34182.bm1@aSuh5Xhi
VirIT	Trojan.Win32.Zbot.MIN
Cyren	W32/Trojan.MRAW-5860
Symantec	Backdoor.Trojan
ESET-NOD32	Win32/TrojanDownloader.Waski.A
Baidu	Win32.Trojan-Downloader.Waski.a
APEX	Malicious
ClamAV	Win.Packed.Upatre-9848576-0
Kaspersky	Trojan-Downloader.Win32.Hyteod.g
NANO-Antivirus	Trojan.Win32.Panda.ddozto
Rising	Downloader.Waski!1.A489 (RDMK:cmRtazqmdlofl4Du6KLW+ZgX6Z87)
Emsisoft	Trojan.Spy.Zbot.FNZ (B)
Comodo	TrojWare.Win32.TrojanDownloader.Upatre.AKJ@5e815w
DrWeb	Trojan.PWS.Panda.7581
Zillya	Downloader.Hyteod.Win32.35
TrendMicro	TROJ_UPATRE.SMX2
McAfee-GW-Edition	Downloader-FSH!8E8DA07998CB
Sophos	ML/PE-A + Mal/Upatre-H
Ikarus	Trojan.Win32.Bublik
Jiangmin	TrojanDownloader.Hyteod.j
Avira	TR/ATRAPS.A.3853
MAX	malware (ai score=85)
Antiy-AVL	Trojan/Generic.ASMalwS.B55ED5
Microsoft	Trojan:Win32/Zbot.svfs!MTB
SUPERAntiSpyware	Trojan.Agent/Gen-Waski
GData	Win32.Trojan-Downloader.Upatre.BK
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Agent.R115402
VBA32	TrojanDownloader.Hyteod
ALYac	Trojan.Spy.Zbot.FNZ
Malwarebytes	Ransom.CryptoWall
Panda	Trj/Zbot.M
TrendMicro-HouseCall	TROJ_UPATRE.SMX2
Tencent	Trojan-Downloader.Win32.Waski.16000151
Yandex	Trojan.DL.Hyteod!R+Rl//KqCg4
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Upatre.Gen
Fortinet	W32/Waski.A!tr.dldr
AVG	Win32:Dropper-gen [Drp]
Avast	Win32:Dropper-gen [Drp]
CrowdStrike	win/malicious_confidence_100% (D)