About “ML/PE-A + Troj/Agent-ADIT” infection

The ML/PE-A + Troj/Agent-ADIT is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What ML/PE-A + Troj/Agent-ADIT virus can do?

Unconventionial language used in binary resources: Russian
Mimics icon used for popular non-executable file format
Anomalous binary characteristics

How to determine ML/PE-A + Troj/Agent-ADIT?


File Info:
name: 91D2AA1FB2805198678C.mlw
path: /opt/CAPEv2/storage/binaries/0edead26b4ceaa251b682ce846e6ce5b1bea60209f53ed4a590985816fab2cd7
crc32: 48CDA8BC
md5: 91d2aa1fb2805198678cd346f7dde92f
sha1: 49304bcefbb7d3c2844eded3e32c714ed3dcccc1
sha256: 0edead26b4ceaa251b682ce846e6ce5b1bea60209f53ed4a590985816fab2cd7
sha512: e570883c705652551ef33cdf01ac5ef60ab0a52872d8d24a074a1f502be3f0e015c53166b7eb15c6624e8e61e4160f7d5e858c0662758c3b01f4fbf8a0ef3dc8
ssdeep: 384:yOybKp5ntkR9sJr7nyodGhpxMR5QYKZseH5SAm:yO2Kp5Esl7yD7QDKVO
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T11DB231B0F582BD73D016453071BAF588092E2E123B9AA51D3EAAF36C47F670134C5E6E
sha3_384: d3d1fc17287044f4be6564b524cbad01c2ab5d0412e066f357cb05f0eef5492fab048e76ad13518b0aa5fe366b4e173b
ep_bytes: 558bec83ec645356575064a130000000
timestamp: 2013-08-27 09:48:40

Version Info:
0: [No Data]

ML/PE-A + Troj/Agent-ADIT also known as:

Bkav	W32.FamVT.GeND.Trojan
Elastic	malicious (high confidence)
DrWeb	Trojan.DownLoad3.28161
MicroWorld-eScan	Trojan.Spy.Zbot.FHF
FireEye	Generic.mg.91d2aa1fb2805198
CAT-QuickHeal	TrojanDownloader.Upatre.A3
ALYac	Trojan.Spy.Zbot.FHF
Cylance	Unsafe
Zillya	Downloader.Small.Win32.71340
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Riskware ( 0040eff71 )
K7GW	Riskware ( 0040eff71 )
Cybereason	malicious.fb2805
BitDefenderTheta	Gen:NN.ZexaF.34182.bmX@aa@3sMhk
VirIT	Trojan.Win32.Generic.CHGU
Cyren	W32/Trojan.LLDF-4766
Symantec	Downloader
ESET-NOD32	Win32/TrojanDownloader.Small.PRL
TrendMicro-HouseCall	TROJ_UPATRE.SM
ClamAV	Win.Trojan.Zbot-59484
Kaspersky	HEUR:Trojan.Win32.Generic
BitDefender	Trojan.Spy.Zbot.FHF
NANO-Antivirus	Trojan.Win32.DownLoad3.cjbusg
Avast	Win32:Zbot-RUD [Trj]
Tencent	Malware.Win32.Gencirc.10b9db37
Sophos	ML/PE-A + Troj/Agent-ADIT
Comodo	TrojWare.Win32.TrojanDownloader.Tiny.NIU@7ajbk5
Baidu	Win32.Trojan-Downloader.Small.by
VIPRE	Trojan.Win32.Kryptik.bixx (v)
TrendMicro	TROJ_UPATRE.SM
Emsisoft	Trojan.Spy.Zbot.FHF (B)
Ikarus	Trojan-Spy.Win32.Zbot
Jiangmin	Trojan/Generic.bakcv
Avira	TR/AD.Yarwi.amqdm
MAX	malware (ai score=84)
Antiy-AVL	Trojan/Generic.ASMalwS.3F86FD
Microsoft	TrojanDownloader:Win32/Upatre.A
GData	Trojan.Spy.Zbot.FHF
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Tepfer.C184755
McAfee	PWSZbot-FFC!91D2AA1FB280
VBA32	BScope.Trojan.Bublik
APEX	Malicious
Rising	Malware.Heuristic!ET#97% (RDMK:cmRtazpdReg2xPK8mjKUSsnr+l1h)
Yandex	Trojan.GenAsa!nhuQdixS3/4
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Upatre.Gen
Fortinet	W32/Tiny.NIV!tr.dldr
AVG	Win32:Zbot-RUD [Trj]
Panda	Trj/Zbot.M
CrowdStrike	win/malicious_confidence_100% (D)

How to remove ML/PE-A + Troj/Agent-ADIT?

ML/PE-A + Troj/Agent-ADIT removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X