Trojan

Trojan-Downloader.Win32.Zload.vho (file analysis)

Malware Removal

The Trojan-Downloader.Win32.Zload.vho is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Trojan-Downloader.Win32.Zload.vho virus can do?

  • Executable code extraction
  • Presents an Authenticode digital signature
  • Creates RWX memory
  • Network activity detected but not expressed in API logs
  • Anomalous binary characteristics

How to determine Trojan-Downloader.Win32.Zload.vho?


File Info:

crc32: 321E886D
md5: 5a8263c98fe7859185bdabf2945649e9
name: upload_file
sha1: 2dc6fcf00ab068449f553aa585a76d23c1ff5a6c
sha256: d47eaed2c55f0a29653978c06b503538712938aaab171f4db3bee9b3adaf02f7
sha512: 4cea0a9e941f09c424156437f03633ea519eb4b424960328c9f1a363d6bf4edd85a22e9b94893f8518be5ee6c4bc01c4d3877d50b8421f3150679d9d67a068c7
ssdeep: 6144:ws3ToPMXLGnQE9NphY64U/jMIuxF8RrnFnknZn3nRmn/nlnenvnxnGn5nPYnhnpW:P3EPMbGnLphKeMIuxKRV7
type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

Version Info:

LegalCopyright: Copyright (C) 2016
InternalName: 360realpro.exe
FileVersion: 8,8,0,1000
OriginalFilename: 360realpro.exe
ProductVersion: 8,8,0,1000
Translation: 0x0409 0x04b0

Trojan-Downloader.Win32.Zload.vho also known as:

BkavW32.AIDetectVM.malware1
Elasticmalicious (high confidence)
MicroWorld-eScanTrojan.GenericKDZ.70573
FireEyeGeneric.mg.5a8263c98fe78591
ALYacTrojan.GenericKDZ.70573
CylanceUnsafe
VIPRETrojan.Win32.Generic!BT
CrowdStrikewin/malicious_confidence_100% (D)
BitDefenderTrojan.GenericKDZ.70573
K7GWSpyware ( 0040f0131 )
K7AntiVirusSpyware ( 0040f0131 )
TrendMicroTrojan.Win32.WACATAC.THJAABO
BitDefenderThetaGen:NN.ZedlaF.34298.Ay9@ae8AUgki
SymantecPacked.Generic.459
Paloaltogeneric.ml
ClamAVWin.Dropper.Zload-9775446-0
KasperskyHEUR:Trojan-Downloader.Win32.Zload.vho
AlibabaTrojan:Win32/ZLoader.3166b9c5
Ad-AwareTrojan.GenericKDZ.70573
SophosMal/EncPk-APV
ComodoMalware@#38xjy21bhhf7i
F-SecureTrojan.TR/AD.ZLoader.xxwsk
InvinceaMal/Generic-R + Mal/EncPk-APV
McAfee-GW-EditionGenericRXMF-AJ!5A8263C98FE7
EmsisoftTrojan-Downloader.Agent (A)
JiangminTrojanDownloader.Zload.du
AviraTR/AD.ZLoader.xxwsk
Antiy-AVLGrayWare/Win32.Kryptik.ehls
MicrosoftTrojan:Win32/ZLoader.AR!Cert
ZoneAlarmHEUR:Trojan-Downloader.Win32.Zload.vho
GDataTrojan.GenericKDZ.70573
CynetMalicious (score: 100)
Acronissuspicious
McAfeeGenericRXMF-AJ!5A8263C98FE7
MAXmalware (ai score=80)
VBA32BScope.Trojan.Diple
MalwarebytesTrojan.Downloader
PandaTrj/GdSda.A
ESET-NOD32a variant of Win32/Kryptik.HGPG
TrendMicro-HouseCallTrojan.Win32.WACATAC.THJAABO
RisingDownloader.Zload!8.118E0 (TFE:5:RTM0j43KIsH)
eGambitUnsafe.AI_Score_100%
FortinetW32/Dridex.DD!tr
AVGWin32:DangerousSig [Trj]
AvastWin32:DangerousSig [Trj]

How to remove Trojan-Downloader.Win32.Zload.vho?

Trojan-Downloader.Win32.Zload.vho removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment