Categories: Malware

ML/PE-A + Troj/Ramnit-AP (file analysis)

The ML/PE-A + Troj/Ramnit-AP is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What ML/PE-A + Troj/Ramnit-AP virus can do?

Behavioural detection: Executable code extraction – unpacking
At least one process apparently crashed during execution
Creates RWX memory
Authenticode signature is invalid

How to determine ML/PE-A + Troj/Ramnit-AP?


File Info:
name: D5DD8225B5720A73C0D9.mlwpath: /opt/CAPEv2/storage/binaries/4700e3fa18908fa00d850d4e1ed03517b476e371564b19967908201856c8db7ccrc32: 6A4B14FAmd5: d5dd8225b5720a73c0d91b57d6845c15sha1: 06c91b2a4cecb967fb776ddeb4f5dfaffc7d4c8asha256: 4700e3fa18908fa00d850d4e1ed03517b476e371564b19967908201856c8db7csha512: 9aaf8c61e86e23c79c5abab30c4dcd3ee25586140c92a404f4c49e9ff945523d4ee863bb4915e3359d941cf855e781244d523d7f3211b18bd9eab2258d553081ssdeep: 1536:i235b7r55bUYWs++ibV561RBhoyH/ltKcvJEZWztiuCSue:L3l55ZWs+RSfBpPKgJttiJSptype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1AAB3D0914388940DE06675BCC081FE2317EABFB5A4D4869769F53C67FA30BF22424A0Bsha3_384: 41e95132c08401a891b0ed4f97f3e77127b406c33134d0f018ec66066c3db9eb45c858d5e8b12f18911193f8beeb3266ep_bytes: 558bec83ec20535657512bf88bf08b35timestamp: 2011-01-21 10:20:55
Version Info:
Comments: CompanyName: Avira GmbHFileDescription: AntiVir Command Line Scanner for WindowsFileVersion: 7.6.0.59InternalName: AntiVir/Win32LegalCopyright: Copyright © 2007 Avira GmbH. All rights reserved.LegalTrademarks: AntiVir® is a registered trademark of Avira GmbH, GermanyOriginalFilename: PrivateBuild: ProductName: ProductVersion: 7.6.0.59SpecialBuild: Translation: 0x0000 0x04b0

ML/PE-A + Troj/Ramnit-AP also known as:

Bkav	W32.Vetor.PE
Elastic	malicious (high confidence)
MicroWorld-eScan	Win32.Virtob.Gen.12
CMC	Virus.Win32.Virut.3!O
CAT-QuickHeal	W32.Virut.G
Cylance	Unsafe
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Trojan ( 005298a21 )
K7GW	Trojan ( 005298a21 )
Cybereason	malicious.5b5720
Baidu	Win32.Virus.Virut.gen
VirIT	Trojan.Win32.Generic.BZL
Cyren	W32/Zbot.EK.gen!Eldorado
ESET-NOD32	Win32/Virut.NBP
APEX	Malicious
ClamAV	Win.Packed.Ramnit-9773470-0
Kaspersky	HEUR:Trojan.Win32.Generic
BitDefender	Win32.Virtob.Gen.12
NANO-Antivirus	Virus.Win32.Virut-Gen.bwpxnc
Avast	Win32:Vitro [Inf]
Tencent	Trojan.Win32.ZBot.bs
Ad-Aware	Win32.Virtob.Gen.12
Emsisoft	Win32.Virtob.Gen.12 (B)
Comodo	Virus.Win32.Virut.CE@1fhkga
DrWeb	Trojan.Rmnet.1
TrendMicro	PE_VIRUX.A
McAfee-GW-Edition	BehavesLike.Win32.Generic.cm
Trapmine	malicious.high.ml.score
FireEye	Generic.mg.d5dd8225b5720a73
Sophos	ML/PE-A + Troj/Ramnit-AP
SentinelOne	Static AI – Malicious PE
GData	Win32.Virtob.Gen.12
Jiangmin	Trojan/Lebag.ke
Avira	W32/Virut.Gen
MAX	malware (ai score=80)
Arcabit	Win32.Virtob.Gen.12
ViRobot	Trojan.Win32.A.Diple.88948.A
Microsoft	Virus:Win32/Virut.BR
Cynet	Malicious (score: 100)
AhnLab-V3	Win32/Virut.E
McAfee	PWS-Zbot.gen.cy
VBA32	BScope.Trojan.Rmnet
Malwarebytes	Trojan.Agent
TrendMicro-HouseCall	PE_VIRUX.A
Rising	Trojan.Win32.ZBot.bs (CLASSIC)
Yandex	Trojan.GenAsa!cmSfJTlOIOM
Ikarus	Virus.Win32.Ramnit
MaxSecure	Virus.Virut.CE
Fortinet	W32/Virut.CE
BitDefenderTheta	AI:FileInfector.C9457D4313
AVG	Win32:Vitro [Inf]
Panda	Trj/Ramnit.F
CrowdStrike	win/malicious_confidence_100% (W)