Malware

Mal/Generic-R + Mal/Zbot-UU (file analysis)

Malware Removal

The Mal/Generic-R + Mal/Zbot-UU is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Mal/Generic-R + Mal/Zbot-UU virus can do?

  • SetUnhandledExceptionFilter detected (possible anti-debug)
  • Behavioural detection: Executable code extraction – unpacking
  • Yara rule detections observed from a process memory dump/dropped files/CAPE
  • Creates RWX memory
  • Possible date expiration check, exits too soon after checking local time
  • Dynamic (imported) function loading detected
  • CAPE extracted potentially suspicious content
  • Authenticode signature is invalid

How to determine Mal/Generic-R + Mal/Zbot-UU?



File Info:

name: E8CA2C9E23D1B91D2297.mlw
path: /opt/CAPEv2/storage/binaries/22aa265d4da859fc36c3d342096453cff175c275c97c441e959c069c01693828
crc32: ADF9C0E7
md5: e8ca2c9e23d1b91d229753b79e8f4d1a
sha1: 3788f747f678e5fd176cacda1f0b8db89c30e68a
sha256: 22aa265d4da859fc36c3d342096453cff175c275c97c441e959c069c01693828
sha512: 887681eb7a7f3198a8da978f4385262ed88c37b80ccfc40699ebc7b287da5e4747275bdaad1685eadd18374025adeca1766f584eb46e8d2c98c53a1cb96cea96
ssdeep: 6144:tQQCwO3NIQSEsazEATM8W7XIINyRoxbhacL6koevWbp3FPU+bMrkdkQwCzvRR0hD:tdOlsazgARe4kyHPU+bGZC1R0/
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T19E256C23EA6C9537E05A09B48867C1B1E2713EC087F88F8779ACB72DD5303E7A535616
sha3_384: f511ea92a58f9ac2c55baf6438d5b1fa707531d35e45762fdaf16ce9d623c86a0dd9dc89ac7c2a5a367d07210fc42656
ep_bytes: e816880000e917feffff6a4068888246
timestamp: 2006-03-30 14:06:03


Version Info:

Comments:  52
ProductVersion: 6, 1, 5633, 9966
CompanyName: BlueToad Agree
FileDescription: Stead Feel
FileVersion: 6, 1, 5633, 9966
InternalName: Stead Feel
LegalCopyright: Copyright 2013 BlueToad Agree. All rights reserved.
OriginalFilename: Docry.exe
ProductName: Stead Feel
Translation: 0x0409 0x04b0

Mal/Generic-R + Mal/Zbot-UU also known as:

LionicTrojan.Win32.Generic.4!c
Elasticmalicious (high confidence)
MicroWorld-eScanGen:Heur.Mint.Zard.52
FireEyeGeneric.mg.e8ca2c9e23d1b91d
CAT-QuickHealTrojan.Sigmal.S2540737
ALYacGen:Heur.Mint.Zard.52
CylanceUnsafe
K7AntiVirusSpyware ( 005293221 )
AlibabaTrojanSpy:Win32/Generic.c30e45b1
K7GWSpyware ( 005293221 )
Cybereasonmalicious.e23d1b
VirITTrojan.Win32.Genus.DKW
CyrenW32/Zusy.BY.gen!Eldorado
SymantecML.Attribute.HighConfidence
ESET-NOD32Win32/Spy.IcedId.D
APEXMalicious
Paloaltogeneric.ml
KasperskyHEUR:Trojan.Win32.Generic
BitDefenderGen:Heur.Mint.Zard.52
NANO-AntivirusTrojan.Win32.IcedID.ezmgwt
AvastWin32:Malware-gen
TencentMalware.Win32.Gencirc.10b1f56e
Ad-AwareGen:Heur.Mint.Zard.52
SophosMal/Generic-R + Mal/Zbot-UU
ComodoTrojWare.Win32.Azden.B@7lxyp9
DrWebTrojan.IcedID.6
ZillyaTrojan.IcedID.Win32.2
TrendMicroTROJ_GEN.R002C0DL821
McAfee-GW-EditionGenericRXEV-PX!E8CA2C9E23D1
EmsisoftGen:Heur.Mint.Zard.52 (B)
IkarusTrojan-Spy.Agent
GDataGen:Heur.Mint.Zard.52
JiangminTrojan.Generic.cbmti
WebrootW32.Trojan.Gen
AviraHEUR/AGEN.1130657
Antiy-AVLTrojan/Generic.ASMalwS.253C6CF
GridinsoftRansom.Win32.Skeeyah.sa
MicrosoftTrojan:Win32/Skeeyah.A!rfn
CynetMalicious (score: 99)
AhnLab-V3Malware/Win32.Generic.C2486338
McAfeeGenericRXEV-PX!E8CA2C9E23D1
MAXmalware (ai score=87)
VBA32BScope.TrojanBanker.IcedID
MalwarebytesMalware.AI.1635315638
TrendMicro-HouseCallTROJ_GEN.R002C0DL821
RisingTrojan.Generic@ML.100 (RDML:DECG9GKGve8B7l5FG4gpdw)
YandexTrojan.PWS.IcedID!U1QNmfmXlME
SentinelOneStatic AI – Malicious PE
eGambitUnsafe.AI_Score_83%
FortinetW32/Zbot.PKJO!tr
BitDefenderThetaGen:NN.ZexaF.34084.7q0@aK9O81ji
AVGWin32:Malware-gen
PandaTrj/Genetic.gen
CrowdStrikewin/malicious_confidence_90% (W)
MaxSecureWin.MxResIcn.Heur.Gen

How to remove Mal/Generic-R + Mal/Zbot-UU?

Mal/Generic-R + Mal/Zbot-UU removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment