ML/PE-A + Mal/Zbot-CX removal

The ML/PE-A + Mal/Zbot-CX is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What ML/PE-A + Mal/Zbot-CX virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Possible date expiration check, exits too soon after checking local time
• Dynamic (imported) function loading detected
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Unconventionial language used in binary resources: Russian
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• The executable is compressed using UPX
• Authenticode signature is invalid

How to determine ML/PE-A + Mal/Zbot-CX?

File Info:
name: F4C6CBAD0AECEDB71C47.mlw
path: /opt/CAPEv2/storage/binaries/d60041c2cd182fa3c3428a1c951d7a72d17d2f98948d8e3384023b84ec559f1c
crc32: B76A8065
md5: f4c6cbad0aecedb71c473aeb2f449738
sha1: e92bbb14b0f418ca094eb48965c61801e548586a
sha256: d60041c2cd182fa3c3428a1c951d7a72d17d2f98948d8e3384023b84ec559f1c
sha512: 4b8f7bcbbf0443d20beaca3de15aa6e582c4c7a2acfe82fd761fb6cab348428c6c811df67b5258f3628a0733d5d84b2a89af56d72cb7132441b4a74a7972979d
ssdeep: 3072:9qOf6u/T+nE5YkXWmb6o5nGUNOqMeOQDl/5vvnYbI+YIdF:RCu7q6Wm2o5N1MyhRvPYF
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T172D312CA3F70974AD9FF007158E9372146A4FA38014AEFAF188D436974BB646D9F219C
sha3_384: e77c6324b9d0d4bdc1847079756de0d65a1563f9062d22f4dca0ae85fee240e50e57cd905ba6514a58b87f9c5a684c61
ep_bytes: 60be159042008dbeeb7ffdff57eb0b90
timestamp: 2007-04-06 04:36:02

Version Info:
CompanyName: Xxjhtkqkgv Xasot
FileDescription: Xxjhtkqkgv Lvlacym Vicghcj
FileVersion: 6, 108, 9, 76
InternalName: Xxjhtkqkgv
LegalCopyright: Copyright © Xxjhtkqkgv Xasot 2001-2009
OriginalFilename: Xxjhtkqkgv.exe
ProductName: Xxjhtkqkgv Lvlacym Vicghcj
ProductVersion: 33, 75, 24, 95
Translation: 0x0409 0x04e4

ML/PE-A + Mal/Zbot-CX also known as:

How to remove ML/PE-A + Mal/Zbot-CX?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.