Win32/Packed.QSetup.AT suspicious removal tips

The Win32/Packed.QSetup.AT suspicious is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Win32/Packed.QSetup.AT suspicious virus can do?

Sample contains Overlay data
Unconventionial language used in binary resources: Hebrew
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid

How to determine Win32/Packed.QSetup.AT suspicious?


File Info:
name: E7F1E5512CEEDD8F8311.mlw
path: /opt/CAPEv2/storage/binaries/aeb8b16e99a9ce15878f88a9e49684cb42f187ec0486fe2f5344f2c34dd5a9b3
crc32: 9CDC2D0B
md5: e7f1e5512ceedd8f83111ffa96234cd6
sha1: 475b7976ed6a70cfb83ef069a1a7058e11af9b9b
sha256: aeb8b16e99a9ce15878f88a9e49684cb42f187ec0486fe2f5344f2c34dd5a9b3
sha512: a6cca449ab91d96d28cfc4943dbf50e393a629eb4cd6951b80f08dbf0b37761875f3c9280c593ccc554c83fbaeab343e561c5e7896286efa10aa7c9421a9c249
ssdeep: 24576:4WmAFubSffk7XGZUyzuu/OSwVWRjVUL4mOicdMSkS6HsW38PSyXk8c7IQnpM9b:U2fMRrSwYRxkCM4WopXfUI0M9b
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T13375127BB2C1803BD1F119388D6793D5246AB7202E2D646F7DE80F9DAD3E092566C2C7
sha3_384: 25b218979678a6de16c4ab4bce140f8b955bb242f32ab077a2e7debedccbc29d1df40e5cf340290c420d68ce3d30d1fc
ep_bytes: 558bec83c4f0b848574200e8e8fffdff
timestamp: 1992-06-19 22:22:17

Version Info:
Comments: 
CompanyName: Pantaray Research Ltd.
FileDescription: Setup SFX Kernel
FileVersion: 9.1.0.6
InternalName: Set-up S-FX Ker-nel
LegalCopyright: Copyright (C) 2002-2008, Pantaray Research Ltd.
LegalTrademarks: 
ProductName: 
ProductVersion: 9.0.0.0
Translation: 0x0409 0x04e4
OriginalFilename: Stub.exe

Win32/Packed.QSetup.AT suspicious also known as:

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Agent.Y!c
ALYac	Trojan.GenericKD.66712385
Malwarebytes	Generic.Trojan.Malpack.DDS
Sangfor	Trojan.Win32.Packed.Vjmd
CrowdStrike	win/malicious_confidence_100% (W)
Alibaba	Packed:Win32/QSetup.1e260b10
K7GW	Trojan ( 005a45851 )
K7AntiVirus	Trojan ( 005a45851 )
Cyren	W32/ABRisk.TPAN-8645
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/Packed.QSetup.AT suspicious
APEX	Malicious
Kaspersky	Backdoor.Win32.Agent.myuoaf
BitDefender	Trojan.GenericKD.66712385
ViRobot	Trojan.Win.Z.Agent.1552400
MicroWorld-eScan	Trojan.GenericKD.66712385
Avast	Win32:Malware-gen
Rising	Trojan.Generic@AI.100 (RDML:QKNaWpYlxpEGZz4eOCO4Pw)
Emsisoft	Trojan.GenericKD.66712385 (B)
F-Secure	Trojan.TR/Redcap.fahns
VIPRE	Trojan.GenericKD.66712385
TrendMicro	TROJ_GEN.R002C0DDR23
McAfee-GW-Edition	BehavesLike.Win32.Dropper.tc
Trapmine	malicious.moderate.ml.score
FireEye	Trojan.GenericKD.66712385
Sophos	Mal/Generic-S
Ikarus	PUA.QSetup
Webroot	W32.Trojan.Gen
Avira	TR/Redcap.fahns
Microsoft	Trojan:Win32/Malgent!MSR
Xcitium	Malware@#3lrccrfzlnode
Arcabit	Trojan.Generic.D3F9F341
ZoneAlarm	Backdoor.Win32.Agent.myuoaf
GData	Trojan.GenericKD.66712385
Google	Detected
AhnLab-V3	Trojan/Win.Agent.C5419662
McAfee	Artemis!E7F1E5512CEE
MAX	malware (ai score=84)
Cylance	unsafe
Panda	Trj/Agent
TrendMicro-HouseCall	TROJ_GEN.R002C0DDR23
Tencent	Malware.Win32.Gencirc.13ac461b
MaxSecure	Trojan.Malware.207018647.susgen
Fortinet	Riskware/Application
AVG	Win32:Malware-gen
DeepInstinct	MALICIOUS

How to remove Win32/Packed.QSetup.AT suspicious?

Win32/Packed.QSetup.AT suspicious removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X