Should I remove “ML/PE-A + Troj/Emotet-CKD”?

The ML/PE-A + Troj/Emotet-CKD is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What ML/PE-A + Troj/Emotet-CKD virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Dynamic (imported) function loading detected
• CAPE extracted potentially suspicious content
• Authenticode signature is invalid
• Uses Windows utilities for basic functionality
• Deletes its original binary from disk
• Attempts to remove evidence of file being downloaded from the Internet
• Installs itself for autorun at Windows startup
• Installs itself for autorun at Windows startup
• CAPE detected the Emotet malware family
• Creates a copy of itself
• Created a service that was not started

How to determine ML/PE-A + Troj/Emotet-CKD?

File Info:
name: 63BD0CD44264DA8E53D4.mlw
path: /opt/CAPEv2/storage/binaries/4fe9f088aaa0a707e70930d87c64e799845088cf29a583058e7f783770717461
crc32: 5F77B024
md5: 63bd0cd44264da8e53d4dcaa865ab105
sha1: 1d03f2e924788dea319e742b07a870f7fec98870
sha256: 4fe9f088aaa0a707e70930d87c64e799845088cf29a583058e7f783770717461
sha512: 333d430fdf5643d2bcf32ae8328c4e80a58fbd6aa5d42e4cce776ad7321fdbed1097b3ab274f942f0b8914b83b9f1d5fb914b9cb904ec05b9c300c71f91c48f8
ssdeep: 6144:C1GLgYu3b3rOm/cLt6nDSfn9i7R4Qmi0dync8K2ArRebTPcQs7LdJ:C1GLgYu3b7O7fnQ7R4TjhrUTPf+r
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T157948C11F7E2E076CDAF02720EA2C66CE6A6BF509A35424737D02BCEDE745818A35771
sha3_384: 2bf42710fb86333493e53e79fee2b0c8a0b3190c865b78ebab9ce49caecfcee79e096da6085b41fe0d7906602ff607f4
ep_bytes: e8ae950000e916feffff5064ff350000
timestamp: 2020-07-20 20:15:25

Version Info:
CompanyName: 
FileDescription: LineCounter MFC Application
FileVersion: 1, 0, 0, 1
InternalName: LineCounter
LegalCopyright: Copyright (C) 2001
LegalTrademarks: 
OriginalFilename: LineCounter.EXE
ProductName: LineCounter Application
ProductVersion: 1, 0, 0, 1
Translation: 0x0409 0x04b0

ML/PE-A + Troj/Emotet-CKD also known as:

How to remove ML/PE-A + Troj/Emotet-CKD?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.