Malware

Mal/Generic-R + Mal/Zbot-ES removal tips

Malware Removal

The Mal/Generic-R + Mal/Zbot-ES is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Mal/Generic-R + Mal/Zbot-ES virus can do?

  • Behavioural detection: Executable code extraction – unpacking
  • Yara rule detections observed from a process memory dump/dropped files/CAPE
  • Creates RWX memory
  • Possible date expiration check, exits too soon after checking local time
  • Dynamic (imported) function loading detected
  • Reads data out of its own binary image
  • CAPE extracted potentially suspicious content
  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid

How to determine Mal/Generic-R + Mal/Zbot-ES?



File Info:

name: D92F04257C3AFBEF11B2.mlw
path: /opt/CAPEv2/storage/binaries/831a4f978c6d8d4b09daeb4a81de3d4a7292a615eb8cffa3bd583311e0c5a801
crc32: 89D1538B
md5: d92f04257c3afbef11b26b64d201b33a
sha1: b5c1f4a1f32984a9f740bce3bfcf4d32fec391a5
sha256: 831a4f978c6d8d4b09daeb4a81de3d4a7292a615eb8cffa3bd583311e0c5a801
sha512: 15de3c91e46ab6bc1ad3decb8bc5efe4d31d62aaf0491b954278b058e31613746846f8732aa094d6e35035f159d29e5db08fb41148d43e9b5d670343582f572f
ssdeep: 3072:4h1ptEPlH8eJMYIM6whO8UOzl8WROR+RYgs:AEP18sIRwhTUBodY
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1EFE3E1AB38C00332F4E6167516A24F65A677781392B2837F6FDC1D1ABF531D01E5A38A
sha3_384: 57df6355f1ba43fdbb2410158d87e08e47adf49f0d7d01e1f33eecebe27717b5b6fb4b3f1158331dd06cd87ff8893cc5
ep_bytes: 6a1868e0504100e8d52c0000bf940000
timestamp: 2011-11-29 12:16:45


Version Info:

0: [No Data]

Mal/Generic-R + Mal/Zbot-ES also known as:

LionicTrojan.Win32.Generic.4!c
Elasticmalicious (high confidence)
CynetMalicious (score: 100)
FireEyeGeneric.mg.d92f04257c3afbef
McAfeePWS-Zbot.gen.bcn
CylanceUnsafe
ZillyaTrojan.Zbot.Win32.48191
SangforPUP.Win32.Barys.44
K7AntiVirusSpyware ( 005705391 )
AlibabaTrojanPSW:Win32/BScope.b6155731
K7GWSpyware ( 005705391 )
CrowdStrikewin/malicious_confidence_90% (W)
VirITTrojan.Win32.Generic.ATQY
SymantecML.Attribute.HighConfidence
ESET-NOD32Win32/Spy.Zbot.YW
APEXMalicious
ClamAVWin.Trojan.Zbot-51342
KasperskyHEUR:Trojan.Win32.Generic
BitDefenderGen:Heur.Pack.Emotet.4
NANO-AntivirusTrojan.Win32.Zbot.jdggj
MicroWorld-eScanGen:Heur.Pack.Emotet.4
AvastWin32:Trojan-gen
TencentWin32.Trojan.Generic.Wqmx
Ad-AwareGen:Heur.Pack.Emotet.4
SophosMal/Generic-R + Mal/Zbot-ES
ComodoMalware@#2qcq2u79sc8ec
DrWebTrojan.PWS.Panda.1490
VIPRETrojan.Win32.Generic!BT
McAfee-GW-EditionBehavesLike.Win32.Trojan.cc
EmsisoftGen:Heur.Pack.Emotet.4 (B)
SentinelOneStatic AI – Malicious PE
GDataGen:Heur.Pack.Emotet.4
JiangminTrojanSpy.Zbot.bjtp
WebrootW32.Infostealer.Gen
AviraTR/Crypt.ZPACK.Gen
MAXmalware (ai score=100)
Antiy-AVLTrojan[Spy]/Win32.Zbot
ArcabitTrojan.Pack.Emotet.4
ViRobotTrojan.Win32.A.Zbot.143360.W
ZoneAlarmHEUR:Trojan.Win32.Generic
MicrosoftPWS:Win32/Zbot!MTB
AhnLab-V3Spyware/Win32.Zbot.C146126
Acronissuspicious
BitDefenderThetaGen:NN.ZexaF.34212.imW@aSgJ8hh
VBA32BScope.TrojanPSW.Zbot.9112
MalwarebytesGeneric.Malware/Suspicious
RisingTrojan.Win32.Generic.12ABF2AC (C64:YzY0Ov6G0OE5+PGj)
IkarusTrojan-Spy.Win32.Zbot
FortinetW32/Kryptik.UWX!tr
AVGWin32:Trojan-gen
Cybereasonmalicious.57c3af
PandaGeneric Malware

How to remove Mal/Generic-R + Mal/Zbot-ES?

Mal/Generic-R + Mal/Zbot-ES removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment