Categories: Malware

PWS:Win32/Zbot.KH (file analysis)

The PWS:Win32/Zbot.KH is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What PWS:Win32/Zbot.KH virus can do?

Behavioural detection: Executable code extraction – unpacking
Creates RWX memory
Dynamic (imported) function loading detected
Enumerates running processes
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
Installs itself for autorun at Windows startup
Likely virus infection of existing system binary
Creates Zeus (Banking Trojan) mutexes

How to determine PWS:Win32/Zbot.KH?


File Info:
name: 10103242772C24AB6B22.mlwpath: /opt/CAPEv2/storage/binaries/eae1b4b6fa02d6e67977c056090e8a8b1000874b2d6a72b61867e964c83cdc3ecrc32: 31117E86md5: 10103242772c24ab6b22bafd6fbe0f1dsha1: 0b3759986e2d73b7b9aebd62eb0f009d50b56e2asha256: eae1b4b6fa02d6e67977c056090e8a8b1000874b2d6a72b61867e964c83cdc3esha512: 6d65dc22112c49d50d1c927cf9232a3f7b2ee715fae087ca7de6959d6623e8c96b5a9ac3813491ba5c4d3aab2d3d94d30f572160d9c2d00b9400c7158169a733ssdeep: 12288:c/OLmV1DFb/B0xNJPFpTBmtjHBX9XDxy4vQjE:cmLk9FbJMJPXVm1t9X1y4WEtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1C89423AAFADA2848F5EE4C374119EC0F3E487D1B15F1C8B257A6885B0BD718058F726Dsha3_384: 2c2ba838f2f37e286a67633ba53a0e9b33cffd182180ab2132ebdbab5b1b709a36a8519634d743196c9c8a3581f6edf3ep_bytes: eb00508bc483ec30c744240a00000000timestamp: 2001-05-09 04:00:33
Version Info:
0: [No Data]

PWS:Win32/Zbot.KH also known as:

Bkav	W32.AIDetect.malware1
Lionic	Trojan.Win32.Zbot.kZAq
Elastic	malicious (high confidence)
DrWeb	Trojan.Packed.511
MicroWorld-eScan	Trojan.Spy.Zeus.1.Gen
FireEye	Generic.mg.10103242772c24ab
ALYac	Trojan.Spy.Zeus.1.Gen
Cylance	Unsafe
VIPRE	Trojan-Spy.Win32.Zbot.ga (v)
Sangfor	Trojan.Win32.Spy.Z
K7AntiVirus	Trojan ( 000204251 )
Alibaba	TrojanPSW:Win32/Kryptik.d58099de
K7GW	Trojan ( 000204251 )
Cybereason	malicious.2772c2
BitDefenderTheta	AI:Packer.1755BCC31E
VirIT	Trojan.Win32.Packed.TR
Cyren	W32/Zbot.J.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Kryptik.N
TrendMicro-HouseCall	TSPY_ZBOT.SMT
Paloalto	generic.ml
ClamAV	Win.Trojan.Zbot-2921
Kaspersky	HEUR:Trojan.Win32.Generic
BitDefender	Trojan.Spy.Zeus.1.Gen
NANO-Antivirus	Trojan.Win32.Zbot.unle
Avast	Win32:Susn-G [Trj]
Tencent	Win32.Trojan.Generic.Dtim
Ad-Aware	Trojan.Spy.Zeus.1.Gen
TACHYON	Trojan-Spy/W32.ZBot.417280.BA
Emsisoft	Trojan.Spy.Zeus.1.Gen (B)
Comodo	Malware@#efqq3rpex3p5
Zillya	Trojan.Zbot.Win32.4778
TrendMicro	TSPY_ZBOT.SMT
McAfee-GW-Edition	BehavesLike.Win32.Generic.gc
Sophos	Mal/Generic-R + ATK/Behav-321
Ikarus	Trojan.Win32.Crypt
GData	Trojan.Spy.Zeus.1.Gen
Avira	TR/Dropper.Gen
Antiy-AVL	Trojan[Spy]/Win32.Zbot
Kingsoft	Win32.Heur.KVMH004.a.(kcloud)
Gridinsoft	Ransom.Win32.Zbot.sa
Arcabit	Trojan.Spy.Zeus.1.Gen
ViRobot	Trojan.Win32.A.Zbot.55296.L
ZoneAlarm	HEUR:Trojan.Win32.Generic
Microsoft	PWS:Win32/Zbot.KH
Cynet	Malicious (score: 100)
AhnLab-V3	Worm/Win32.IRCBot.C92440
Acronis	suspicious
McAfee	Generic PWS.cq
MAX	malware (ai score=100)
VBA32	Trojan.Inject.01376
Malwarebytes	Malware.AI.3158351200
APEX	Malicious
Rising	Trojan.Win32.Ntos.hl (CLOUD)
Yandex	TrojanSpy.ZBot.Gen!Pac.6
SentinelOne	Static AI – Malicious PE
eGambit	Generic.Malware
Fortinet	W32/Zbot.W!tr
AVG	Win32:Susn-G [Trj]
Panda	Generic Malware
CrowdStrike	win/malicious_confidence_100% (D)