Categories: Malware

ML/PE-A + Troj/SalLoad-C removal guide

The ML/PE-A + Troj/SalLoad-C is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What ML/PE-A + Troj/SalLoad-C virus can do?

Executable code extraction
Injection with CreateRemoteThread in a remote process
Attempts to connect to a dead IP:Port (1 unique times)
Creates RWX memory
A process attempted to delay the analysis task.
Expresses interest in specific running processes
Installs a browser addon or extension
The binary likely contains encrypted or compressed data.
Code injection with CreateRemoteThread in a remote process
Crashed cuckoomon during analysis. Report this error to the Github repo.
Installs itself for autorun at Windows startup
Operates on local firewall’s policies and settings
Attempts to disable UAC
Attempts to modify or disable Security Center warnings
Attempts to block SafeBoot use by removing registry keys
Anomalous binary characteristics
Attempts to modify Explorer settings to prevent hidden files from being displayed

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine ML/PE-A + Troj/SalLoad-C?


File Info:
crc32: 711409A0md5: 0e50b608ff22d9b7c4199ac70ac2c907name: 0E50B608FF22D9B7C4199AC70AC2C907.mlwsha1: f2250577ca2aab66b98cb9ed6b18d25f170b768dsha256: 2587e54017f3a8c968e9bf25a6ca69fae6d5f840b23bbac4e4a37c7a7497e02esha512: 22b58582d7a3bc40f3d35f892264b72dd41ef54c85bb1b5fbe5e25b1eb42299c887d0ee41812d16185cfd8872cc6e61967cfb22fe57fe42055b6987a77fab822ssdeep: 1536:tQI4tCDyziDO5HNZ3H3PwgyzURLb6duLCg6UgWGTrZU+gDa2Re6bOm:t3UCDyzdHZ3P5yzob64CmwZ6e28atype: PE32 executable (GUI) Intel 80386, for MS Windows
Version Info:
0: [No Data]

ML/PE-A + Troj/SalLoad-C also known as:

Bkav	W32.Sality.PE
Elastic	malicious (high confidence)
ClamAV	Win.Trojan.Agent-36126
FireEye	Generic.mg.0e50b608ff22d9b7
CAT-QuickHeal	W32.Sality.U
McAfee	W32/Sality.gen.z
Cylance	Unsafe
Zillya	Virus.Sality.Win32.17
Sangfor	Win.Trojan.Agent-36126
K7AntiVirus	Trojan ( 001cddbb1 )
BitDefender	Win32.Sality.3
K7GW	Trojan ( 001cddbb1 )
CrowdStrike	win/malicious_confidence_100% (D)
Baidu	Win32.Trojan.Sality.p
Cyren	W32/Sality.gen2
Symantec	W32.Sality!dr
TotalDefense	Win32/Sality.AA
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	Virus.Win32.Sality.gen
NANO-Antivirus	Virus.Win32.Sality.beygb
ViRobot	Win32.Sality.N.Host
MicroWorld-eScan	Win32.Sality.3
Rising	Malware.Heuristic!ET#99% (RDMK:cmRtazpoWe6chFF3f87iwjTK34SV)
Ad-Aware	Win32.Sality.3
Sophos	ML/PE-A + Troj/SalLoad-C
Comodo	Virus.Win32.Sality.gen@1egj5j
F-Secure	Malware.W32/Sality.AT
DrWeb	Win32.Sector.31
VIPRE	Virus.Win32.Sality.at (v)
TrendMicro	PE_SALITY.RL-O
McAfee-GW-Edition	BehavesLike.Win32.Ardurk.cc
Emsisoft	Win32.Sality.3 (B)
SentinelOne	Static AI – Malicious PE
Jiangmin	Win32/HLLP.Kuku.poly2
Avira	W32/Sality.AT
MAX	malware (ai score=87)
Antiy-AVL	Virus/Win32.Sality.gen
Microsoft	Virus:Win32/Sality.AT
Arcabit	Win32.Sality.3
SUPERAntiSpyware	Trojan.Agent/Gen-CDesc[Gen]
ZoneAlarm	Virus.Win32.Sality.gen
GData	Win32.Sality.3
AhnLab-V3	Win32/Kashu.E
Acronis	suspicious
BitDefenderTheta	AI:FileInfector.A5ECCBAB0E
ALYac	Worm.Sality.3.Gen
TACHYON	Virus/W32.Sality.D
VBA32	Virus.Win32.Sality.bakc
Malwarebytes	Trojan.MalPack.Gen
Panda	W32/Sality.AK.drp
ESET-NOD32	Win32/Sality
TrendMicro-HouseCall	PE_SALITY.RL-O
Tencent	Trojan.Win32.SalityStub.a
Yandex	Trojan.GenAsa!gQiCZ6kxGcc
Ikarus	Virus.Win32.Sality
MaxSecure	Trojan.LordPE
Fortinet	W32/LPECrypt.A!tr
AVG	Win32:Sality [Inf]
Cybereason	malicious.8ff22d
Avast	Win32:Sality [Inf]
Qihoo-360	Trojan.Win32.SalityStub.A