ML/PE-A + Troj/Ransom-AKD removal instruction

The ML/PE-A + Troj/Ransom-AKD is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What ML/PE-A + Troj/Ransom-AKD virus can do?

• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Possible date expiration check, exits too soon after checking local time
• Anomalous file deletion behavior detected (10+)
• Dynamic (imported) function loading detected
• Reads data out of its own binary image
• A process created a hidden window
• Unconventionial language used in binary resources: Portuguese (Brazilian)
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Created a process from a suspicious location
• Anomalous binary characteristics

How to determine ML/PE-A + Troj/Ransom-AKD?

File Info:
name: 161F40316CD528B1C75D.mlw
path: /opt/CAPEv2/storage/binaries/ea81ccad4b55a32f94c721fac4cf554f21c4900128b6a18b4ea87a746dedde58
crc32: DB222A29
md5: 161f40316cd528b1c75d55831c50452d
sha1: 7f526f4c8a8d0491bfe892efe12dbb22cb340363
sha256: ea81ccad4b55a32f94c721fac4cf554f21c4900128b6a18b4ea87a746dedde58
sha512: 46bd6f906ccc71a5e9a05330ba21676ed260c2b85e440493a556796937e01347a1d73d09ab775c1380d6ee1b8dee47724bc8be2dfd3e9de9a6f840f5872eb327
ssdeep: 384:N9xdUqG1E/ew1Zz/aH59N1Drb+E1H63Vs17o/WsB:PxdIm/hZGHrqE1H63A7o/WI
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T14AA2C4B773D24CF1F6A707B0A876624BA49074D153D236FF4A1E9E104D02AC6EAF12C9
sha3_384: 2148b005e445880d1cfcb7f3c82e479f69dd69fd7d5494e452f6c30bab6c9602a8e61b8c9391f2874fc3b50c7dd63008
ep_bytes: 558bec83ec4456ff150c2040008bf08a
timestamp: 1992-06-01 18:44:46

Version Info:
0: [No Data]

ML/PE-A + Troj/Ransom-AKD also known as:

How to remove ML/PE-A + Troj/Ransom-AKD?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.