Trojan.Dropper.ZMD removal

The Trojan.Dropper.ZMD is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.Dropper.ZMD virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• NtSetInformationThread: attempt to hide thread from debugger
• Possible date expiration check, exits too soon after checking local time
• Guard pages use detected – possible anti-debugging.
• Dynamic (imported) function loading detected
• Performs HTTP requests potentially not found in PCAP.
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• Authenticode signature is invalid
• A ping command was executed with the -n argument possibly to delay analysis
• Uses Windows utilities for basic functionality
• Attempted to write directly to a physical drive
• Attempts to create or modify system certificates
• Collects information to fingerprint the system
• Uses suspicious command line tools or Windows utilities

How to determine Trojan.Dropper.ZMD?

File Info:
name: 0AA14CADD0CC13D6FB3C.mlw
path: /opt/CAPEv2/storage/binaries/0f8cda85dfdb1324f8bc295a2f6e9d565e8c52a992b191324703fe707c365c7e
crc32: C681C890
md5: 0aa14cadd0cc13d6fb3c96906fd28218
sha1: 4dc14fcd15ff3851489789bef1fc8d9a3ea47db6
sha256: 0f8cda85dfdb1324f8bc295a2f6e9d565e8c52a992b191324703fe707c365c7e
sha512: 232bf1d42a7eff630ffa0db384e7e5af23e866dc3cce5122a6ef10173b70aaf779bb5d49233b7676f5f2207130addffaed9229091dabfb8a87655134143ca792
ssdeep: 98304:WjINUurgRvBMpSsW/klOEtm4oQdSUBWEIp2m8ZEwAcPNTnxuaPC:WjsUeCvipjbH9wUBW9d8ZEwAMnxup
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1FC2633CABFCB1433DCAAC23945789A32AC3A79F4DA60B6515F50A9050499CCF7501FBB
sha3_384: a7a08998e30b3d2e1c401e673f16d6b6b1da8c6439ce36db1cf8744438e1246709f6699888b204e73a8b101575f78340
ep_bytes: 81ecd4020000535556576a2033ed5e89
timestamp: 2012-02-24 19:20:04

Version Info:
FileDescription: 
FileVersion: 0.0.0
LegalCopyright: 
ProductVersion: 0.0.0
Translation: 0x0000 0x04b0

Trojan.Dropper.ZMD also known as:

How to remove Trojan.Dropper.ZMD?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.