Malware

Mal/Zbot-AH malicious file

Malware Removal

The Mal/Zbot-AH is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Mal/Zbot-AH virus can do?

  • Behavioural detection: Executable code extraction – unpacking
  • Sample contains Overlay data
  • CAPE extracted potentially suspicious content
  • The binary contains an unknown PE section name indicative of packing
  • Authenticode signature is invalid
  • CAPE detected the embedded win api malware family
  • Yara detections observed in process dumps, payloads or dropped files

How to determine Mal/Zbot-AH?


File Info:

name: 3AA782C5E0C68E5FAC16.mlw
path: /opt/CAPEv2/storage/binaries/4a6f05cc371add6a5c86d94f2cf0364a3b46279fd1259c1dd401fc89ba2ab018
crc32: FB3F6D28
md5: 3aa782c5e0c68e5fac16d0ee330ea0e7
sha1: cb8337d52461f8c7f297becc2ffc1bb83ae5a3eb
sha256: 4a6f05cc371add6a5c86d94f2cf0364a3b46279fd1259c1dd401fc89ba2ab018
sha512: f576c2716e25dbecb1c92040814cf6527312ca15759a83d9a702e7de63a01476a8ef59d1bceac5975294c7bda658a3bed88283e4f1ac1c0b08717c8878748e4d
ssdeep: 12288:nhf5ZlTAvTkeeYgvRtwBJ7OhII89ZGxsDoXgajFmrfs3pp:hfXKTkeUtwBJ7OhlplSfK
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T137C423A63AAC5E2AF6E6CBB117F25710D52297D41C1803DF2336B0C416F71A5BE4D22B
sha3_384: 705a1bed6f77a4bf072bc6dae944fe12d7082b223b68c7e04abdc600eda507c3398e0f53934a485008850c06d3f44d39
ep_bytes: 609896e92cd60100c744242457e24100
timestamp: 2005-07-12 17:07:59

Version Info:

CompanyName: SOFTWIN
드䚨긬挶揁곺䡤⣁ud8e1⎽㽢怀緷銹皍ⳟ蟙ꔐ莃響僷귦udb6e㮴︞뫵됢跌⻛₱뺝豢ٙ곷璡弓妿洊⬑ꥺ엾곇㩰쉉쒘闢ࢆ防鯷鸉쑮픢蒆퐎펆ٮⴶ呥䷱ō㧼튩縖獛뵐ᘘ星崘쒰稒㩻镧찛涞䌐䚗眻放᪫⎴쵏䬂⇦ꣾ᳎꩖䅘糛俺䅻稜: ᜄᰎ⨟ᵦくఋຸㅂ䙡琋ⶪ쩭ɯȁቨቒ㫧㠢ᒇఙ、᪟ 㜘䥏펀၁؈丂蘶儿嘛汷䐦簆芗歮ᱍժ煖؄ܵఒἪ谶ㄺ匒ؚ䡇ࠆ੘ᶱ万傡᪙溿Ú㽅䈸恼༄ᕉᙀ⁸丆⚶蘄鄅娽倢辬ᯣȯ܃ᬑℷ镳ἃ乆׏╆圊​伸ᑀ稩ⴆ啓䠐준☗ᬯ⼒Ὰ缋ᜯ㌐ꍵㅁ⠣䅀⤄ᄃ塼☂ᔉ䴆⎅焽떕嬑ʸྣॹ㘺ᢑ᠞홳ጌ⨍٘戻⥖㌘耷ጨᨽĄ塝ؑ㈀偕ప七ᕝ吁؉ཫ㐘؁㤔᾿ďભ㋒ᤩ၌帋Ƅʝ堤䀗ꯐ΀嬴匂②؏㠱輐鬅攽؟ᑌ广ཨ⌈谄༕ᰀ䀃ㄤᘯᰝ脵ȇ䜙訖ɂ瀠⼵䬀㞩ଈ㑉ꉀ植ԫ࡙㐠ฟԄȚਾ氮ᖭḍ؝蠁橵䱕ᬾ褃ⵧృཕⱉᕁ㣓ᡣᥓἭᨏᬂܗ詤嘐ᘓ爁䤁芍籜ȓudb09⼕땪ơ扡؅蝡㘓᭕༑븓㛭箛㞍䢿‼㰀欜戢ꙙ㐡䴤㌩ᢘ뮈㠕㜅ย䫓圼ᚃ⸫ᴪ㈤੔ⶁ稄ဝന斺눀⫛㌀⁩ㄗ摅ᢗኋ⸽顩̄Вᠽ᪙䘘楰ᫎ㔂⠰⼖࿇윛稵ԓᨙᬡ孰넦坢г䘛핯ẃ∣㬞㞃⡆鼁Ⰻ⃝絽⍿Ԁ⼔୸㠂Όᘟ䰈ᔁ꣈ㄮ爌ܲ䢁䀖ማ愳鐐a䜓턂흚ᐁ䎎읆蘟᝻ဇ๧託掊⼹刿戅ȉИ᐀谅㐢‧꜓欔逄斏ܜŒ⼃⥕ѣ嗍ᰍँud92a㘄ud9b4漐傄␇ậഉଃൟ洦䐋牐ⱍ梾⨏က攞쑼ฺ抵岙ᑄ煟Ȉ⴪㰯ᅎ㤇ᘇʤȷ匯㜙밽鉘㆕ㄬఖɴ㜜歭䨵蠊ᠯЈĘ䨄ঈశ褍䌐ᅤ欘刂́扱㨀㰨ᔌ␥ɩḨሜ挃䰧ᤙ乡ѫ͢ጨ幠⤏㬰赞䎋ࡳ眎崶݃蜢8ᢣ桼笗⤃ⱅ摶㜅።ላ਍倹ါ╆⌌笲넨寖娈≟٪ᔀ̒圅ᩏ譒㴁ͫą䊖ݖፒ⑙븺 ⬥䬆эฆ’萎꼟ఓ〵Ȇဋ틐♯༥㗈纕蔈쎛᎚픗䡊㌆㬗톉᜹붏猻䒣攺ၗḑꤒ⸚ἔԕఞ᠐ᴂاꔈᮋ൙ѱ嬇⤏ᰞ将㭏Я땂㌜䈿楝ᕧ⵲材䴈ബᔛ䈧鱄✚ܚ霊ԑϦԎ阆఺匧⤋㕢ʏ漋䔶ᰀࢉ㴓腟䴀讗ऴ☦༝䨪億Ğᩒ्ꬋ篠㔄ᤎ굫朥娪䨇ీ缓划戇기䥛Ȇц㌰栁꠾Ⱥธ≫┚䴅യ崤ⵃਪ㼈帐ຕ堀ᤇ衸䕓鸣艼ude08斁䖏ᬳᐈဒ娂䨃♒䍭┇㐅⍆お䥵呫孱扰ᰫ옇ᘲ曝ᨗ賃ₓ瀤警开᜻灂ⅴ丿ẗ鰖㐁ଈ洠❲Ŕ୧ᱵ卬䨴ᘂ樖ꚍ„ᠾཋ୑㌓ݐ䪹唏ک熄༖庆≘⸌ीࠓఁ퉎ؤ夐㑯腚㉘،䠊怂✝啾പ麻ᨥဥࠗ禓⸍᡹আ錑ᬯㄘ౐ݮ㆘ろ࡜ݯļ笁ؗ瓂ܓر末Ḭܕ叕୸ࡩ罴ꋦ꘽몟ud80cଁ橽悎㐍䠜቙薎ᨂȀ栊b鸁钋會✀Ɯ悼漼؁㸆ᄓ䬆⼄捐ඐ帻䬊䴔剏ʹ蜢ᬂ㴍㜐「ⴁࢫ塃ы㔫Åഃ࠙跛鞧㄀耜ѐॉ侥幩謪๰Ĭ椃縆抮ᠦ䈁Λ䢠㠌س붜㈥⼁ㅍ杔㐝૑܎†쁟娈㈼蠷↗樞㌂듐࠴␘㞜噟楞ɶűᶕ靧ʽᘔᗔꍪ娏ఖऄ‑⑜ı謐揖ud854น肊ȋ鄩༛ȁἰ굶͌㈈㉞䔊ి再砭䷫᥎䈏博羅⢂ଓ葡꬀ੴᐼⲟ佌ⱜ 꺕䲠㡞؇㜂đḏᡸ桰吀ᰖ䳂鮴ᄏ⌖⺆ꬋ␏䠖̃ꢍሼࠝ潡ၡ娐ຕ텛Ă᳗ ̦娛ᄆ摩ȗᄧℙ㐶䠦↓㘬嬹䶢春᠀̰ἄ뎆愶㌮ਠ崲鬈ଥ䘢ᡧ쬲⹿䔋䐆ܗ⌄M䰫㲔؆Ṝ䌃ၡܻ䐻Ҍř꬛䬰紖᭖ㄈ∘朝ц∠猓鉔䠔ᰶɫ཮ᜇ恆䀊实栬䈕蘀☱㠔啨䘻攪Ћ㬬툈윘ᔊ㬱ቋud85b琂〾깊吮ข䔡ስ閈඾砧เ㮋鬋切쌏ᨠ⡶夥੕憝呗⢥䀀ꐹ䜷✯錂㖃Љ坟슔尉ȁ䈴ᬠ쌏뜆⤙吆䄉ᐉ䂨㍠Ћഘᡑค䥊โ 䰆蕮စ⸚榝ࠢ娊睟༶પ묂䴊ᴙ℀佉ॖ䁪䨖位ः鱂⬶࡟℅Ɖढ़༾㬑␋тࠟ༰ѓࠝ╡ᔆጷ㔾ྮ屖蠪ၢ洅䠀ȉ㬕਼zࠔ℀匌ᕍ唡łꀦޞ䅃㥘垥ണ଺h嵓兦䨡⭥䭒✱㵛͟漏❔䔡㬾錓ˊܭ␀᠃焳Ő⍗㩉┱ਅ鈯䤉鮓讟孅趇┧ḉȟ୥剹ℸ䤋㊨▐ባ″訥怎㜊⥗蕶 ᅎԑᴺെ伜넖㤨剶윮䄚☼㖺₋缲先ꔊ挻렁譋尖ѾІud802ṵ❤礴㐙ଓ깽ㄎĢ成䔹ݨ❊ԏŎ≖ꪕ有ⴽᥛ┉ꄗ꾄㉂捧ᜈὠั̉ค亏呙䱎ʘᆦ鄂ʿ഻udd01ᐅ。⨠㘺ᖙ檙杜漥夔✅ꑺॉ날ഒ╆⌙⑟ᴤ䅇Dዂ̏Ɉᬆ뾏 ἴĺ㙰䐀瀗堕⡳ἀ 敇ḇȱдฒĹ플䨒ۀ밅‐ጤॱ蕧蘁䡉Ɇ᭙ਈ™田య␍̥嘓ᲞڋÓؐ⌯뀛ጫ䰍ࠀ岠瘫▋Ἆၻ⬀ē唻鼀Ꮑᱻ霕ķꨲ؏ܢᆣ玤Ɵ㉅क़㬒‹ὒɺ䒦䜘찪∧݀䈈㴒͔扨⬏䔊搪匶ख⥃ࠊᕖ䠼圼ᔑ⤛夁栂ꄞ⼊帑䌛हꐄȝᵝ鲥옂ਂ≵՟嬏݂餫졉̅ݷ᳚⬉ĝ딌̑ሆ鈖伊讂眶湭ఌЍ∌⚲Ἐᑸἲꈃ鬀䉯ḿᝑꘀ⚬犆譺㵸琽斖㼋夤〕⭃끊漚ஂ䵤礧化ܨš⪉ഡ࠱ᴠꊀ␛ሁऔᄐ䕜笾ጆᴢ軆꼔䨊ᔄ℧㨹ꔁ䈉遻ͬ䨁㹯ࠍĚ적㸹疢⢕ଋ㨷ॡᵋ㤇䯬╱ᥟ㙲ⴲⴊ蜸㌏丑鄫杌ud81aᨆࡗ崊⠂捚痠ᰙᤙ䝏㐆ᘨᒚꀜᝣ枙넰怌皶ⶣଢ଼᝔Gਘခ敐䒪⼃ᐤ㸝駑̙䄳㐎p䔗譇㱩؜蝢朷妢쐃Оļ伲܁␓帕⭶稗ഺ谑౱猂䄢餣ᴖᢩᠬȝ़輙ꤗܐᯉ怘ṍ啔尅刴䪳䐾舀ᙗ㡙䜅Җġ抌᥌䉛ก䡽)㨆ओ쩁⁷ᰇ⭕ᨺ؅䐖밮Ḏᤚ匃䛧玧왆茤屠欽ᄆ皣猪ᘘ㴰䎐੢ဘ᱐ᩕ阛䊵刞鼣ጫ㼙㮥ᅮᄰ䉔㊈⸤䬔Ԋ複啚堘Ŗ褒܍䮥ฅuda5c㴂螙СΜ剅⠞ԃ虻垢⊙஛梂蠐脵ᶝ㜝↥⨏뜗渜ਝ਻ⷦꌟ퍁㰃蜊✂Зݤᩨ匲挀ₛ怰໇犴〉璍፮Ж๡唼ᬂᩭ┿匡ḧᰱ┶е⡜᜸枪氥䠙⼱ܳጀ୯萾❥ṅ与ἆ̪茽慓٤Ⱖὕ된ᐅᡇ찰အ씘祇ᬬ 岊౷卑욅ጭ䜉䑷㤤☙넀䁡㘶ᬊ㖿끌嶩⽦ݯጉ儸ጜ᫗@ّࠢ覻㔝㬍射剸᦯砙✌⌡䤬ᰵ䷒儫ऊେᗟЀᔄ且癲퐋㔡坧ਉᬂ㠥ⴖ༇ಌ☫烛긅ْ贈Ўሢudc8a愞⩭ᒊᵄᒞ籏⡷籏啞ቫࡄ睄㉑彉⡏㼍༮ܹ䁠䈂ਏ댿煋♎ঐ⏜Ḝ⤘㼎桊ꆠ畇ဃࠄȃ㘳༅/Ἴ傥똾倉⤊ጢ鸊ရ嘫ଂज٩ᝂ㐥̈ㄕ̺䴫㪁䴥䠌鹪ҝ㢊ᅴ࠿―ग़ᤳĩ枋ďএ猔ᝢᴗ夅ചል挵ቆ༆ਫ਼ᴎ㳂ԭ㥦∆ᬈ㤚磈ƒਛʪĈ䌊ᘒ阆䑕ࠊⴘ묊궬暦⬁ላ३9ሂ㎯斦줐Ȝ㸱甜栿॔⨁♛പᑆ䵯䬦䭝瀆舤᠕첹Лሓ쁔ᐕ㠞ⴇ중複፳ሀ圍͙ᘆ䖓❓‹䄇ଠȁᆐ㵊Ω໛暢窹现⠄礗ƒ谳ॳ䧙娗!ד昷ᬱ港ᤨᤉ䐵㹹琄턽−⽣鬕栀洦ⵓ

Mal/Zbot-AH also known as:

BkavW32.AIDetectMalware
Elasticmalicious (high confidence)
MicroWorld-eScanGen:Variant.Zbot.10
FireEyeGeneric.mg.3aa782c5e0c68e5f
SkyhighBehavesLike.Win32.Generic.hc
ALYacGen:Variant.Zbot.10
ZillyaTrojan.Scar.Win32.27913
SangforTrojan.Win32.Save.a
K7AntiVirusSpyware ( 0055e3db1 )
AlibabaPacked:Win32/FakeAlert.ca5076a3
K7GWSpyware ( 0055e3db1 )
CrowdStrikewin/malicious_confidence_100% (W)
ArcabitTrojan.Zbot.10
BitDefenderThetaGen:NN.ZexaF.36744.IK3@aC0661nG
VirITTrojan.Win32.Cryptic.AJT
SymantecML.Attribute.HighConfidence
ESET-NOD32Win32/Spy.Zbot.UN
APEXMalicious
ClamAVWin.Trojan.Scar-4380
KasperskyPacked.Win32.Krap.hl
BitDefenderGen:Variant.Zbot.10
NANO-AntivirusVirus.Win32.Gen.ccmw
AvastWin32:MalOb-CK [Cryp]
TencentWin32.Packed.Krap.Jqil
EmsisoftGen:Variant.Zbot.10 (B)
F-SecureTrojan.TR/Crypt.ZPACK.Gen
DrWebTrojan.PWS.Panda.171
VIPREGen:Variant.Zbot.10
TrendMicroTROJ_KRYPTK.SMM
SophosMal/Zbot-AH
SentinelOneStatic AI – Malicious PE
JiangminTrojan/Scar.acqi
WebrootW32.Backdoor.Gen
GoogleDetected
AviraTR/Crypt.ZPACK.Gen
VaristW32/FakeAlert.OG.gen!Eldorado
Antiy-AVLTrojan[Packed]/Win32.Krap
KingsoftWin32.HeurC.KVMH008.a
XcitiumMalware@#jw6bne8jjepu
MicrosoftTrojan:Win32/DSSDetection
ZoneAlarmPacked.Win32.Krap.hl
GDataGen:Variant.Zbot.10
CynetMalicious (score: 100)
AhnLab-V3Packed/Win32.Krap.R41467
Acronissuspicious
McAfeeArtemis!3AA782C5E0C6
VBA32Malware-Cryptor.General.3
PandaTrj/CI.A
TrendMicro-HouseCallTROJ_KRYPTK.SMM
RisingTrojan.Ditertag!8.F693 (TFE:1:7KS15PZcM0F)
YandexTrojan.Scar!szZ/mpJofVA
IkarusTrojan.Spy.ZBot
MaxSecureTrojan.Malware.1439293.susgen
FortinetW32/Kryptik.AJ!tr
AVGWin32:MalOb-CK [Cryp]
Cybereasonmalicious.52461f
DeepInstinctMALICIOUS

How to remove Mal/Zbot-AH?

Mal/Zbot-AH removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment