Malware

Mal/Generic-R + Mal/Zbot-CX information

Malware Removal

The Mal/Generic-R + Mal/Zbot-CX is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Mal/Generic-R + Mal/Zbot-CX virus can do?

  • Behavioural detection: Executable code extraction – unpacking
  • Yara rule detections observed from a process memory dump/dropped files/CAPE
  • Creates RWX memory
  • Possible date expiration check, exits too soon after checking local time
  • Dynamic (imported) function loading detected
  • Reads data out of its own binary image
  • CAPE extracted potentially suspicious content
  • Unconventionial language used in binary resources: Russian
  • The binary contains an unknown PE section name indicative of packing
  • The binary likely contains encrypted or compressed data.
  • The executable is compressed using UPX
  • Authenticode signature is invalid

How to determine Mal/Generic-R + Mal/Zbot-CX?



File Info:

name: 4A008E6C593A5534951D.mlw
path: /opt/CAPEv2/storage/binaries/e8ed78752006314c1a96373e2ede487c6e7d7207c9738987df0c326adb10aac1
crc32: 0CEF40B8
md5: 4a008e6c593a5534951d40471dd9bcfe
sha1: ae938102ca96e4b191ec9eb4b5c4dddf4d67fae4
sha256: e8ed78752006314c1a96373e2ede487c6e7d7207c9738987df0c326adb10aac1
sha512: 46ee12960bb2a1c882e39a6ec8544324a88847750baa5b719069b5c5cac267ec0abc3977b1e773e45d074ded9332221844860c46e85d44e49a13a3a9f37a70b9
ssdeep: 3072:9qOf6u/T+nE5YkXWmb6o5nGUNOqMeOQDl/5vvnYbI+YndF:RCu7q6Wm2o5N1MyhRvPYU
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T116D312CA3F70974AD9BF00B118ED3B3146A4FA38054ADF6F198D43A960BF646D5F2158
sha3_384: e1247ab0b3f1aca98c57f32ab7aa7afa233d6bf26998ea99fd8620b88fe3485ef6b45abc969e8e32ca4675e873378a6b
ep_bytes: 60be159042008dbeeb7ffdff57eb0b90
timestamp: 2007-04-06 04:36:02


Version Info:

CompanyName: Xxjhtkqkgv Xasot
FileDescription: Xxjhtkqkgv Lvlacym Vicghcj
FileVersion: 6, 108, 9, 76
InternalName: Xxjhtkqkgv
LegalCopyright: Copyright © Xxjhtkqkgv Xasot 2001-2009
OriginalFilename: Xxjhtkqkgv.exe
ProductName: Xxjhtkqkgv Lvlacym Vicghcj
ProductVersion: 33, 75, 24, 95
Translation: 0x0409 0x04e4

Mal/Generic-R + Mal/Zbot-CX also known as:

BkavW32.MosquitoQKK.Fam.Trojan
LionicTrojan.Win32.Zbot.l!c
Elasticmalicious (high confidence)
ClamAVWin.Trojan.Zbot-25206
FireEyeGeneric.mg.4a008e6c593a5534
CAT-QuickHealWorm.SlenfBot.Gen
McAfeeW32/Pinkslipbot.gen.af
CylanceUnsafe
ZillyaTrojan.Zbot.Win32.32418
K7AntiVirusTrojan ( f1000f011 )
AlibabaTrojanSpy:Win32/Kryptik.e9e133f5
K7GWTrojan ( f1000f011 )
Cybereasonmalicious.c593a5
VirITTrojan.Win32.Generic.AGBY
CyrenW32/Zbot.CN.gen!Eldorado
SymantecW32.Qakbot!gen5
ESET-NOD32a variant of Win32/Kryptik.LHD
APEXMalicious
CynetMalicious (score: 100)
KasperskyTrojan-Spy.Win32.Zbot.uczz
BitDefenderGen:Heur.VIZ.2
NANO-AntivirusTrojan.Win32.Zbot.iehuf
SUPERAntiSpywareTrojan.Agent/Gen-Faker
MicroWorld-eScanGen:Heur.VIZ.2
AvastWin32:Trojan-gen
TencentWin32.Trojan-spy.Zbot.Pboy
Ad-AwareGen:Heur.VIZ.2
EmsisoftGen:Heur.VIZ.2 (B)
ComodoTrojWare.Win32.TrojanSpy.Zbot.G@2tckk5
DrWebTrojan.Packed.21467
VIPREBackdoor.Win32.Qakbot.ax (v)
TrendMicroBKDR_QAKBOT.SMG
McAfee-GW-EditionW32/Pinkslipbot.gen.af
SophosMal/Generic-R + Mal/Zbot-CX
IkarusGen.Variant.Zbot
GDataGen:Heur.VIZ.2
JiangminTrojanSpy.Zbot.avpy
eGambitGeneric.Malware
AviraTR/Crypt.XPACK.Gen
Antiy-AVLTrojan/Generic.ASMalwS.D8E43B
ArcabitTrojan.VIZ.2
ViRobotTrojan.Win32.A.Zbot.136704.AM
ZoneAlarmTrojan-Spy.Win32.Zbot.uczz
MicrosoftPWS:Win32/Zbot
AhnLab-V3Trojan/Win32.Zbot.R3226
BitDefenderThetaGen:NN.ZexaF.34212.imKfa4dizAic
ALYacGen:Heur.VIZ.2
MAXmalware (ai score=99)
VBA32Trojan.Zeus.EA.0999
TrendMicro-HouseCallBKDR_QAKBOT.SMG
RisingTrojan.Win32.Generic.127DB21A (C64:YzY0OmoCRLrA19f1)
YandexTrojan.GenAsa!4WH+IIOLK0M
SentinelOneStatic AI – Malicious PE
MaxSecureTrojan.Malware.300983.susgen
FortinetW32/Kryptik.NAS!tr
WebrootW32.Infostealer.Zeus
AVGWin32:Trojan-gen
PandaBck/Qbot.AO
CrowdStrikewin/malicious_confidence_60% (D)

How to remove Mal/Generic-R + Mal/Zbot-CX?

Mal/Generic-R + Mal/Zbot-CX removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment