Categories: Malware

About “ML/PE-A + Mal/Zbot-KC” infection

The ML/PE-A + Mal/Zbot-KC is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What ML/PE-A + Mal/Zbot-KC virus can do?

Sample contains Overlay data
HTTPS urls from behavior.
Reads data out of its own binary image
CAPE extracted potentially suspicious content
Drops a binary and executes it
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
Behavioural detection: Injection (Process Hollowing)
Behavioural detection: Injection (inter-process)
Attempts to modify proxy settings
Harvests cookies for information gathering
Anomalous binary characteristics

How to determine ML/PE-A + Mal/Zbot-KC?


File Info:
name: 91A41F243DD24CF67F2C.mlwpath: /opt/CAPEv2/storage/binaries/ce8202fdfa243cc441e53e73fe86f3093b3bc8ea0128c13c9a8afed041a269b8crc32: AD324835md5: 91a41f243dd24cf67f2cb8a00d332a51sha1: 207687102e12140d6dcf2c7bcbd750d4073f60fasha256: ce8202fdfa243cc441e53e73fe86f3093b3bc8ea0128c13c9a8afed041a269b8sha512: b9852d649dbfec4c04e333d2a1357db0587fe296304f10b55d349da63c914a7ae850ef8322e9c0299b29e37734fbe7c8b312c264fcc2e32c5f02816e2342290dssdeep: 3072:MTfw0tOGDCAJUytrjkDxthjNXBF4BpGUTJ:MTUGeWvWtDxFCp9ttype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T111D3CE167B42DA32DC050974456285C1EBFF2E833E9A9C6B9F443E7E5AB03F474792A0sha3_384: 6fb57b9d0b6e94deda99d611fd61d394b8a776a54d2192727e9758f3b3952745747affe36346dbc515a9c39ca796067bep_bytes: e853170000e916feffff558bec81ec28timestamp: 2009-01-15 01:28:57
Version Info:
FileDescription: LKuds cl ssdFileVersion: 0, 1, 2, 0InternalName: SSDLegalCopyright: United StatesOriginalFilename: SystemProductName: Windows baseProductVersion: 0, 0, 0, 0Translation: 0x0409 0x04b0

ML/PE-A + Mal/Zbot-KC also known as:

Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Heur.Mint.Zitirez.iq1@cethUfliIc
ClamAV	Win.Virus.Blocker-751
FireEye	Generic.mg.91a41f243dd24cf6
CAT-QuickHeal	Trojan.Vundo.Gen
ALYac	Gen:Heur.Mint.Zitirez.iq1@cethUfliIc
Cylance	Unsafe
VIPRE	Gen:Heur.Mint.Zitirez.iq1@cethUfliIc
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Riskware ( 0040eff71 )
K7GW	Riskware ( 0040eff71 )
CrowdStrike	win/malicious_confidence_60% (D)
VirIT	Backdoor.Win32.Butirat.IU
Cyren	W32/Zbot.EW.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	Win32/SpyVoltar.A
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	HEUR:Trojan.Win32.Generic
BitDefender	Gen:Heur.Mint.Zitirez.iq1@cethUfliIc
NANO-Antivirus	Trojan.Win32.Butirat.bfqthv
Avast	Win32:Injector-CRP [Trj]
Rising	Trojan.SpyVoltar!1.6564 (CLASSIC)
Ad-Aware	Gen:Heur.Mint.Zitirez.iq1@cethUfliIc
Emsisoft	Gen:Heur.Mint.Zitirez.iq1@cethUfliIc (B)
Comodo	TrojWare.Win32.Crypt.BS@7iu3rb
DrWeb	BackDoor.Butirat.228
Zillya	Trojan.SpyVoltar.Win32.131
McAfee-GW-Edition	Vundo-FAYV!91A41F243DD2
Trapmine	suspicious.low.ml.score
Sophos	ML/PE-A + Mal/Zbot-KC
Ikarus	Virus.Win32.Vundo
GData	Gen:Heur.Mint.Zitirez.iq1@cethUfliIc
Jiangmin	Trojan/Jorik.fzte
Avira	TR/Neconyd.A.71
MAX	malware (ai score=80)
Antiy-AVL	Trojan/Generic.ASMalwS.60F
Arcabit	Trojan.Mint.Zitirez.E33A7A
ViRobot	Trojan.Win32.A.Blocker.126976.AC
Microsoft	Trojan:Win32/Neconyd.A
Google	Detected
AhnLab-V3	Trojan/Win32.Blocker.R50980
McAfee	Vundo-FAYV!91A41F243DD2
VBA32	Backdoor.Buterat
Malwarebytes	Malware.AI.3079724277
Tencent	Malware.Win32.Gencirc.10b788f5
Yandex	Trojan.GenAsa!vLNtD3Z2U80
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/Zbot.KC!tr
BitDefenderTheta	Gen:NN.ZexaF.34698.iq1@aethUfli
AVG	Win32:Injector-CRP [Trj]
Cybereason	malicious.43dd24
Panda	Trj/Genetic.gen