The Zbot.10 (B) is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.
Gridinsoft Anti-Malware
Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
What Zbot.10 (B) virus can do?
- Behavioural detection: Executable code extraction – unpacking
- Yara rule detections observed from a process memory dump/dropped files/CAPE
- Creates RWX memory
- Mimics the system’s user agent string for its own requests
- Dynamic (imported) function loading detected
- At least one IP Address, Domain, or File Name was found in a crypto call
- Performs HTTP requests potentially not found in PCAP.
- Starts servers listening on 0.0.0.0:39528, :0
- Enumerates running processes
- Reads data out of its own binary image
- CAPE extracted potentially suspicious content
- Drops a binary and executes it
- Unconventionial language used in binary resources: Arabic (Syria)
- The binary contains an unknown PE section name indicative of packing
- Authenticode signature is invalid
- Uses Windows utilities for basic functionality
- Code injection with CreateRemoteThread in a remote process
- Behavioural detection: Injection (inter-process)
- Behavioural detection: Injection with CreateRemoteThread in a remote process
- Tries to unhook or modify Windows functions monitored by Cuckoo
- Collects and encrypts information about the computer likely to send to C2 server
- Installs itself for autorun at Windows startup
- Attempts to modify proxy settings
- Collects information to fingerprint the system
- Anomalous binary characteristics
How to determine Zbot.10 (B)?
File Info:
name: 8C797D35A3B1339A97FC.mlwpath: /opt/CAPEv2/storage/binaries/ff016d8ef66111d4b9cf8e183da5e48db05f91e76b2c8bf8cd9a99b053a4895dcrc32: 1FFF6BAFmd5: 8c797d35a3b1339a97fc5bacf6f91fe3sha1: f7cfe2f8660b1db217ab61a59ef8af8ba554552asha256: ff016d8ef66111d4b9cf8e183da5e48db05f91e76b2c8bf8cd9a99b053a4895dsha512: 2a233cf7b28ecba6620186e1ec608ee50443d88c517c7952adea730d3c0501f3568dfc422cf53b1299b20bd4fd05687a4e062b4d55b58e2abdc9425fd46b7068ssdeep: 1536:mJzf8WYTW+0iMc5/qSRwNGBfsET1eFNB0c:m50Nf5/7wwB5o/Jtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1F1A301AB3C779129CED01DB196A7C43CE6F39E1279C48A85F58D930A5F397037C5A828sha3_384: 06c28d836e960b69170a21df8361255129af7c4c42e2f290378fa0edbb76f63aa06879809a34438206335c2aa12df214ep_bytes: 8d8604a4d344660fb6c39c64a1300000timestamp: 2005-06-20 20:58:20Version Info:
CompanyName: †SOFTWINᢹ㭼⌲Ꞟⲕ⭏ߚ웏崐ٵ䷄㤳匋ӵ持뻷쐩輒㨰捣큚䀝弙⨩팝䩪瓉著룼苶톛쟦ᚷᮙ罅媏盎ﱩ딯즩㪅쩅㳒伤鎳ﱇ凝嘿馞㏂ව屦udeeaኩɘꢴ搃凵⃕ݧ꛰찑H⬶늓哌噥缽ﵦ安ᄔ뭋⽺턴⿇踂碸ᘊᰭ僉蝸ꬩ캑ﱦ쀵頣⍡禷嬛隧骻㦰箏ﵒ䅺ﱳᑉ늭㦓舆࣎뽚獪ꃾᜃའᣮ慫唸乤udce5쀨擪뭆Ϲ聧ᐗ葓ᥪꇬꐮԍṻợꫴ뛬픧涘췘ৰ侲炾껧ⴀ苏쮽횛羍ຎ흂덱碡精ᜦꡕㄝ靚䒣⻙畜尷̓椤ꎭ楡믝甴昦郍兹牭ફⳙ잿䪲읖햂蜔볍蒥坸砼@熞츸龕㦃稦瓴鉪슀鰅泷◳忰箕껖련硯홭Ẻ풿笞藟ꟑ磑Ὥ糦✝ꔷƨ涌急栶馹udccd쭽쓯轺⧻删⋬䁹혻鮓ꉅ熁桉ס␏騲ᓋ題某皂䠄곢玉鳫鋷굼꿁玍淄㬉괯큗窾豣ㅔ냺먳ﱍ䓷ᚐﶚ䍏賹ⳮ炚අ믉❳穈睊㓦㱀㼼浸敶獲潩㵮ㄢ〮•湥潣楤杮∽呕ⵆ∸猠慴摮污湯㵥礢獥㼢ാ㰊獡敳扭祬砠汭獮∽牵㩮捳敨慭業牣獯景潣㩭獡ㅶ•慭楮敦瑳敖獲潩㵮ㄢ〮㸢†愼獳浥汢䥹敤瑮瑩൹ ††瘠牥楳湯∽⸱⸰⸰∰†††牰捯獥潳䅲捲楨整瑣牵㵥堢㘸ഢ ††渠浡㵥䴢物湡慤䴮物湡慤䴮物湡慤ഢ ††琠灹㵥眢湩㈳ഢ ⼠ാ 㰠敤捳楲瑰潩㹮楍慲摮㱡搯獥牣灩楴湯ാ 㰠牴獵䥴普浸湬㵳產湲猺档浥獡洭捩潲潳瑦挭浯愺浳瘮∲ാ †㰠敳畣楲祴ാ ††㰠敲畱獥整偤楲楶敬敧㹳††††爼煥敵瑳摥硅捥瑵潩䱮癥汥†††††敬敶㵬愢䥳癮歯牥ഢ ††††甠䅩捣獥㵳昢污敳⼢ാ ††㰠爯煥敵瑳摥牐癩汩来獥ാ †㰠猯捥牵瑩㹹†⼼牴獵䥴普㹯†搼灥湥敤据㹹††搼灥湥敤瑮獁敳扭祬ാ †††㰠獡敳扭祬摉湥楴祴††††††祴数∽楷㍮∲††††††慮敭∽楍牣獯景楗摮睯潃浭湯䌭湯牴汯≳††††††敶獲潩㵮㘢〮〮〮ഢ †††††瀠潲散獳牯牁档瑩捥畴敲∽㡘∶††††††異汢捩敋呹歯湥∽㔶㔹㙢ㄴ㐴捣ㅦ晤ഢ †††††氠湡畧条㵥⨢ഢ †††⼠ാ †㰠搯灥湥敤瑮獁敳扭祬ാ 㰠搯灥湥敤据㹹†搼灥湥敤据㹹††搼灥湥敤瑮獁敳扭祬ാ †††㰠獡敳扭祬摉湥楴祴††††††祴数∽楷㍮∲††††††慮敭∽楍牣獯景楗摮睯摇灩畬≳††††††敶獲潩㵮ㄢ〮〮〮ഢ †††††瀠潲散獳牯牁档瑩捥畴敲∽㡘∶††††††異汢捩敋呹歯湥∽㔶㔹㙢ㄴ㐴捣ㅦ晤ഢ †††††氠湡畧条㵥⨢ഢ †††⼠ാ †㰠搯灥湥敤瑮獁敳扭祬ാ 㰠搯灥湥敤据㹹†挼浯慰楴楢楬祴砠汭獮∽牵㩮捳敨慭業牣獯景潣㩭潣灭瑡扩汩瑩ㅶ㸢††愼灰楬慣楴湯ാ ††㰠畳灰牯整佤⁓摉∽㍻ㄵ㠳㥢ⵡ搵㘹㐭扦ⵤ攸搲愭㐲〴㈲昵㌹絡⼢ാ †㰠愯灰楬慣楴湯ാ 㰠振浯慰楴楢楬祴ാ㰊愯獳浥汢㹹:
Zbot.10 (B) also known as:
Bkav | W32.AIDetect.malware1 |
Lionic | Hacktool.Win32.Krap.x!c |
Elastic | malicious (high confidence) |
MicroWorld-eScan | Gen:Variant.Zbot.10 |
FireEye | Generic.mg.8c797d35a3b1339a |
CAT-QuickHeal | TrojanPWS.Zbot.Y10 |
ALYac | Gen:Variant.Zbot.10 |
Cylance | Unsafe |
Zillya | Trojan.Kryptik.Win32.83706 |
Sangfor | Trojan.Win32.Krap.hd |
K7AntiVirus | Trojan ( 0055dd191 ) |
Alibaba | Packed:Win32/Kryptik.b984620f |
K7GW | Trojan ( 0055dd191 ) |
Cybereason | malicious.5a3b13 |
VirIT | Trojan.Win32.Generic.KHR |
Cyren | W32/FakeAlert.OG.gen!Eldorado |
Symantec | ML.Attribute.HighConfidence |
ESET-NOD32 | a variant of Win32/Kryptik.ASLG |
APEX | Malicious |
ClamAV | Win.Trojan.Agent-708476 |
Kaspersky | Packed.Win32.Krap.hd |
BitDefender | Gen:Variant.Zbot.10 |
NANO-Antivirus | Trojan.Win32.Krap.czpem |
SUPERAntiSpyware | Trojan.Agent/Gen-Backdoor[Softwin] |
Avast | Win32:MalOb-CK [Cryp] |
Tencent | Win32.Packed.Krap.Ecuj |
Ad-Aware | Gen:Variant.Zbot.10 |
Emsisoft | Gen:Variant.Zbot.10 (B) |
Comodo | Packed.Win32.Krap.hd@2nkc7n |
DrWeb | Trojan.PWS.Panda.383 |
VIPRE | Trojan.Win32.Zbot.im (v) |
TrendMicro | TROJ_KRYPTK.SMM |
McAfee-GW-Edition | Generic PWS.te |
Sophos | Mal/Generic-R + Mal/Zbot-IM |
Ikarus | Trojan.Win32.Crypt |
GData | Gen:Variant.Zbot.10 |
Jiangmin | Packed.Krap.daot |
Webroot | W32.InfoStealer.Zeus |
Avira | TR/Crypt.XPACK.Gen2 |
Antiy-AVL | Trojan/Generic.ASMalwS.F413DF |
Arcabit | Trojan.Zbot.10 |
ZoneAlarm | Packed.Win32.Krap.hd |
Microsoft | PWS:Win32/Zbot |
Cynet | Malicious (score: 100) |
AhnLab-V3 | Win-Trojan/Kazy.Gen |
Acronis | suspicious |
McAfee | Generic PWS.te |
MAX | malware (ai score=100) |
VBA32 | Trojan.Zeus.EA.01000 |
Malwarebytes | Malware.Heuristic.1003 |
TrendMicro-HouseCall | TROJ_KRYPTK.SMM |
Rising | Trojan.Kryptik!8.8 (CLOUD) |
Yandex | Trojan.GenAsa!YxVs5XK2mOk |
SentinelOne | Static AI – Malicious PE |
MaxSecure | Trojan.Malware.1440924.susgen |
Fortinet | W32/Kryptik.AJ!tr |
BitDefenderTheta | Gen:NN.ZexaF.34212.gO0@aC28NedI |
AVG | Win32:MalOb-CK [Cryp] |
Panda | Trj/Krap.Y |
CrowdStrike | win/malicious_confidence_100% (D) |
How to remove Zbot.10 (B)?
- Download and install GridinSoft Anti-Malware.
- Open GridinSoft Anti-Malware and perform a “Standard scan“.
- “Move to quarantine” all items.
- Open “Tools” tab – Press “Reset Browser Settings“.
- Select proper browser and options – Click “Reset”.
- Restart your computer.
Leave a Comment