Malware

What is “Mal/Generic-R + Mal/Zbot-EZ”?

Malware Removal

The Mal/Generic-R + Mal/Zbot-EZ is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Mal/Generic-R + Mal/Zbot-EZ virus can do?

  • Behavioural detection: Executable code extraction – unpacking
  • At least one process apparently crashed during execution
  • SetUnhandledExceptionFilter detected (possible anti-debug)
  • Yara rule detections observed from a process memory dump/dropped files/CAPE
  • Creates RWX memory
  • Dynamic (imported) function loading detected
  • Reads data out of its own binary image
  • CAPE extracted potentially suspicious content
  • Drops a binary and executes it
  • The binary contains an unknown PE section name indicative of packing
  • The binary likely contains encrypted or compressed data.
  • The executable is compressed using UPX
  • Authenticode signature is invalid
  • Uses Windows utilities for basic functionality
  • Deletes its original binary from disk
  • Tries to unhook or modify Windows functions monitored by Cuckoo
  • Collects information to fingerprint the system

How to determine Mal/Generic-R + Mal/Zbot-EZ?



File Info:

name: 961C185766C187DF8168.mlw
path: /opt/CAPEv2/storage/binaries/0ede4b2d64c2aba0e56f0dc599f3d2636e89a696d5476169718eede71c405aac
crc32: 6A5D8AC0
md5: 961c185766c187df8168b46468666273
sha1: 43ad405d106701935dbc43f371743dab49bcbce3
sha256: 0ede4b2d64c2aba0e56f0dc599f3d2636e89a696d5476169718eede71c405aac
sha512: 32383cae3d4335c39579b17e6d31cfc1e189c1456f259a8efbf1684a7047312db2883075a09e872b1c38b9609b471dedda93cd6bbf80b545dbaf0cb8b282c93d
ssdeep: 6144:7GJ4hDPmOcwMa7rW6m0jVPcTbwHwWJm8R2jGYH8SoSS:7GJCGwM8+0jyAF88YH8SoSS
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1EE34235655C1C2AAD0AE237B11FB0889D5FCB5542BE98700E889313B6C9532FEB4DE37
sha3_384: 946ec6b9f01659b20a403fa37b016f509a02cdeb7f410bd7d1c522b0b72af4bd08077e5f5fed9268e78b7c652f593b2a
ep_bytes: 60be00d042008dbe0040fdff5789e58d
timestamp: 2011-02-04 22:45:26


Version Info:

CompanyName: Orb Networks
FileDescription: Sill Ibid Otis
FileVersion: 1.10
InternalName: Five Flinch Uvula
LegalCopyright: Peter Snafu Loses 2003 2005
OriginalFilename: Alkali.exe
ProductName: Shiny
Translation: 0x0409 0x04b0

Mal/Generic-R + Mal/Zbot-EZ also known as:

BkavW32.AIDetect.malware2
LionicTrojan.Win32.Generic.ljLt
Elasticmalicious (high confidence)
DrWebTrojan.PWS.Panda.2111
MicroWorld-eScanGen:Trojan.Heur.Zbot.6
FireEyeGeneric.mg.961c185766c187df
CAT-QuickHealTrojanPWS.Zbot.Y
ALYacGen:Trojan.Heur.Zbot.6
CylanceUnsafe
VIPRETrojan.Win32.Reveto.D (v)
SangforTrojan.Win32.Gen.6
K7AntiVirusTrojan ( 005685bd1 )
AlibabaTrojan:Win32/Kryptik.0cb220cc
K7GWTrojan ( 005685bd1 )
CrowdStrikewin/malicious_confidence_70% (W)
BitDefenderThetaAI:Packer.EB5647A916
CyrenW32/Zbot.DP.gen!Eldorado
SymantecPacked.Generic.350
ESET-NOD32a variant of Win32/Kryptik.AAAB
TrendMicro-HouseCallTSPY_ZBOT.IFC
Paloaltogeneric.ml
KasperskyHEUR:Trojan.Win32.Generic
BitDefenderGen:Trojan.Heur.Zbot.6
NANO-AntivirusTrojan.Win32.Inject.bdatia
SUPERAntiSpywareTrojan.Agent/Gen-Faker[desc]
AvastFileRepMalware
TencentWin32.Trojan.Zbot.Hrey
Ad-AwareGen:Trojan.Heur.Zbot.6
SophosMal/Generic-R + Mal/Zbot-EZ
ComodoTrojWare.Win32.Kryptik.ZWX@4mhf54
ZillyaDropper.Injector.Win32.16997
TrendMicroTSPY_ZBOT.IFC
McAfee-GW-EditionBehavesLike.Win32.Generic.dc
EmsisoftGen:Trojan.Heur.Zbot.6 (B)
IkarusTrojan.Win32.Reveton
JiangminTrojanDropper.Injector.kpw
WebrootW32.Malware.Gen
AviraTR/Crypt.ULPM.Gen
MAXmalware (ai score=100)
Antiy-AVLTrojan/Generic.ASMalwS.1D1C75F
MicrosoftPWS:Win32/Zbot!ml
ZoneAlarmHEUR:Trojan.Win32.Generic
GDataGen:Trojan.Heur.Zbot.6
CynetMalicious (score: 100)
AhnLab-V3Spyware/Win32.Zbot.R19830
Acronissuspicious
McAfeeArtemis!961C185766C1
VBA32BScope.Trojan.Winlock
MalwarebytesTrojan.VUPX.ON
APEXMalicious
RisingRansom.Blocker!8.12A (CLOUD)
YandexTrojan.Kryptik!EQqVTr3wIx0
SentinelOneStatic AI – Malicious PE
MaxSecureTrojan.Malware.7164915.susgen
FortinetW32/Kryptik.ABC!tr
AVGFileRepMalware
Cybereasonmalicious.766c18
PandaTrj/CI.A

How to remove Mal/Generic-R + Mal/Zbot-EZ?

Mal/Generic-R + Mal/Zbot-EZ removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment