ML/PE-A + Troj/Agent-BGVO (file analysis)

Malware Removal

The ML/PE-A + Troj/Agent-BGVO is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware - Review 2020

GridinSoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend to use GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the TRIAL period.
6-day free trial available.

What ML/PE-A + Troj/Agent-BGVO virus can do?

  • Possible date expiration check, exits too soon after checking local time
  • A process attempted to delay the analysis task.
  • Attempts to connect to a dead IP:Port (5 unique times)
  • A process created a hidden window
  • HTTP traffic contains suspicious features which may be indicative of malware related traffic
  • Performs some HTTP requests
  • Unconventionial language used in binary resources: Chinese (Simplified)
  • Uses Windows utilities for basic functionality
  • Steals private information from local Internet browsers
  • Exhibits possible ransomware file modification behavior
  • Writes a potential ransom message to disk
  • Anomalous binary characteristics
  • Uses suspicious command line tools or Windows utilities

Related domains:

www.listincode.com
ocsp.digicert.com
iplogger.org
statuse.digitalcertvalidation.com
ocsp.comodoca.com
ocsp.usertrust.com
ocsp.sectigo.com
www.iyiqian.com
www.khcyysy.com

How to determine ML/PE-A + Troj/Agent-BGVO?


File Info:

crc32: FDB0270E
md5: 61e0ed3cd468c91cd0641939a519c720
name: 61E0ED3CD468C91CD0641939A519C720.mlw
sha1: 4ce08fff1ffd2c6fa5390eaf3a6a78b7b41e1532
sha256: 6c976231d3a4957256814dcba485579c8b1ae5d31d9e8650db52f1eb5d13e6f3
sha512: 332fd0d63982f185e91f646fe8365583b31ed47ddacc8669364a5c24d1f475e037485be4ba40d0b739b67091a48264414982fe508e22db9d063162d9d852fe08
ssdeep: 24576:HIVFA1pqtg/TnMbX0lwyh0FVmEByU1fwFYyOs6bQCH6S8q4AQ8Yfwv:mFA1pvTMbOwa0TmYpMYEQNH6S8cQ8Y4
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

LegalCopyright: Copyright (C) 2019
FileVersion: 1.0.0.1
ProductVersion: 1.0.0.1
Translation: 0x0409 0x04b0

ML/PE-A + Troj/Agent-BGVO also known as:

BkavW32.LungQ.Trojan
K7AntiVirusSpyware ( 005690661 )
Elasticmalicious (high confidence)
DrWebTrojan.Siggen13.57604
CynetMalicious (score: 100)
CAT-QuickHealTrojan.DisbukRI.S19305183
ALYacGen:Variant.Zusy.371633
ZillyaTrojan.Socelars.Win32.767
SangforTrojan.Win32.Save.a
CrowdStrikewin/malicious_confidence_60% (W)
K7GWSpyware ( 005690661 )
Cybereasonmalicious.cd468c
CyrenW32/Socelars.G.gen!Eldorado
SymantecML.Attribute.HighConfidence
ESET-NOD32a variant of Win32/Spy.Socelars.S
APEXMalicious
AvastWin32:PWSX-gen [Trj]
ClamAVWin.Malware.Razy-9789744-0
KasperskyHEUR:Trojan.Script.Generic
BitDefenderGen:Variant.Zusy.371633
MicroWorld-eScanGen:Variant.Zusy.371633
TencentMalware.Win32.Gencirc.10cea1fd
Ad-AwareGen:Variant.Zusy.371633
SophosML/PE-A + Troj/Agent-BGVO
BitDefenderThetaGen:NN.ZexaF.34142.y10@amxsYwgj
McAfee-GW-EditionBehavesLike.Win32.Generic.th
FireEyeGeneric.mg.61e0ed3cd468c91c
EmsisoftTrojan-Spy.Socelars (A)
SentinelOneStatic AI – Malicious PE
JiangminTrojan.PSW.Disbuk.da
AviraHEUR/AGEN.1124060
Antiy-AVLTrojan/Generic.ASMalwS.345DB2F
MicrosoftTrojanSpy:Win32/Socelars.PAA!MTB
ArcabitTrojan.Zusy.D5ABB1
SUPERAntiSpywareTrojan.Agent/Gen-SpySocelars
ZoneAlarmHEUR:Trojan.Script.Generic
GDataGen:Variant.Zusy.371633
TACHYONTrojan/W32.Agent.1448448.AA
AhnLab-V3Infostealer/Win.Socelars.R372531
McAfeeGenericRXLT-RQ!61E0ED3CD468
MAXmalware (ai score=89)
VBA32BScope.Trojan.Agentb
MalwarebytesGlupteba.Backdoor.Bruteforce.DDS
PandaTrj/Genetic.gen
RisingStealer.FBAdsCard!1.CE03 (CLASSIC)
MaxSecureTrojan.Malware.300983.susgen
AVGWin32:PWSX-gen [Trj]
Paloaltogeneric.ml

How to remove ML/PE-A + Troj/Agent-BGVO?

ML/PE-A + Troj/Agent-BGVO removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

Leave a Comment