Trojan

How to remove “Trojan.Downloader.Agent.ZCR (B)”?

Malware Removal

The Trojan.Downloader.Agent.ZCR (B) is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Trojan.Downloader.Agent.ZCR (B) virus can do?

  • Behavioural detection: Executable code extraction – unpacking
  • Sample contains Overlay data
  • Yara rule detections observed from a process memory dump/dropped files/CAPE
  • Reads data out of its own binary image
  • The binary contains an unknown PE section name indicative of packing
  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid
  • Checks for the presence of known windows from debuggers and forensic tools
  • CAPE detected the PoisonIvy malware family
  • Checks for the presence of known devices from debuggers and forensic tools
  • Checks for the presence of known devices from debuggers and forensic tools
  • Anomalous binary characteristics

How to determine Trojan.Downloader.Agent.ZCR (B)?


File Info:

name: 5E0F09CB44C643BEA777.mlw
path: /opt/CAPEv2/storage/binaries/0931cb4038edf2595415c40d03d3e8dc1552ed1c504e39b7b39226ac3b04deeb
crc32: FE990A06
md5: 5e0f09cb44c643bea7776eb7944055a0
sha1: 2b70541d6210b9a7511e4b0165af4a803c67e28d
sha256: 0931cb4038edf2595415c40d03d3e8dc1552ed1c504e39b7b39226ac3b04deeb
sha512: 14c13d18c910d20216291e9c2df91a1e1329723a42cb9542ad2d1c22f7e2f9de19331b83a6b4c6ce56660a02029fa1240f5e6ca7b81aad63c1ccb70780926648
ssdeep: 3072:8tllxkNpcYChI53sZKwhmzdahgAW4V5btiXlbtdHM:8tlzTh884whUAmc5bt+bD
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1D8C3029F640B9124D2F8BC70C59A020D3B6DE13706D9B2B2E4329691A61FC7F67DADD0
sha3_384: 1a8b6a77f25aa70ab3b0084a192568066ff5f1a1e8d22da1370b7e9dbce606a969d50df3a8e659e7086eb443d90a58bf
ep_bytes: eb03cd288c50eb04843235a8e82d0000
timestamp: 2008-01-06 14:51:31

Version Info:

0: [No Data]

Trojan.Downloader.Agent.ZCR (B) also known as:

BkavW32.AIDetect.malware1
LionicTrojan.Win32.Generic.l7af
Elasticmalicious (high confidence)
DrWebBackDoor.Poison.1032
MicroWorld-eScanTrojan.Downloader.Agent.ZCR
FireEyeGeneric.mg.5e0f09cb44c643be
McAfeeArtemis!5E0F09CB44C6
CylanceUnsafe
VIPRETrojan.Downloader.Agent.ZCR
SangforBackdoor.Win32.Poison.E
K7AntiVirusTrojan ( 004b9ca01 )
AlibabaBackdoor:Win32/Poison.04e341e2
K7GWTrojan ( 004b9ca01 )
CrowdStrikewin/malicious_confidence_100% (W)
BitDefenderThetaAI:Packer.F36655D11E
CyrenW32/Poison.H.gen!Eldorado
SymantecML.Attribute.HighConfidence
ESET-NOD32a variant of Win32/Poison
ZonerProbably Heur.ExeHeaderL
APEXMalicious
Paloaltogeneric.ml
KasperskyBackdoor.Win32.Poison.kcdd
BitDefenderTrojan.Downloader.Agent.ZCR
NANO-AntivirusTrojan.Win32.Poison.jrzm
AvastWin32:Evo-gen [Trj]
TencentWin32.Backdoor.Poison.Tzfl
Ad-AwareTrojan.Downloader.Agent.ZCR
EmsisoftTrojan.Downloader.Agent.ZCR (B)
ComodoBackdoor.Win32.Poison.CPB@18el99
ZillyaBackdoor.Poison.Win32.1301
TrendMicroTROJ_GEN.R002C0DI122
McAfee-GW-EditionBehavesLike.Win32.PWSZbot.cc
Trapminemalicious.high.ml.score
SophosML/PE-A
SentinelOneStatic AI – Malicious PE
JiangminBackdoor/PoisonIvy.cev
WebrootW32.PoisonIvy.Gen
GoogleDetected
AviraTR/Crypt.XPACK.Gen
MAXmalware (ai score=100)
Antiy-AVLTrojan/Generic.ASMalwS.3303
KingsoftWin32.Troj.Poison..(kcloud)
MicrosoftBackdoor:Win32/Poison.E
ArcabitTrojan.Downloader.Agent.ZCR
ViRobotBackdoor.Win32.S.Poison.124928
GDataTrojan.Downloader.Agent.ZCR
CynetMalicious (score: 100)
AhnLab-V3Trojan/Win32.Poison.C57892
Acronissuspicious
VBA32Backdoor.Poison
TACHYONBackdoor/W32.Poison.124928.D
MalwarebytesMalware.Heuristic.1003
TrendMicro-HouseCallTROJ_GEN.R002C0DI122
RisingTrojan.Generic@AI.100 (RDML:4UPfM4T1vFhyykpvc6NrFQ)
YandexTrojan.Agent!9t1qNizsBTU
IkarusBackdoor.Win32.Prorat
MaxSecureTrojan.Malware.813717.susgen
FortinetW32/Poison.RFG!tr.bdr
AVGWin32:Evo-gen [Trj]
Cybereasonmalicious.b44c64
PandaGeneric Malware

How to remove Trojan.Downloader.Agent.ZCR (B)?

Trojan.Downloader.Agent.ZCR (B) removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment