Spy Trojan

About “Trojan-Spy.Win32.Zbot.arby” infection

Malware Removal

The Trojan-Spy.Win32.Zbot.arby is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Trojan-Spy.Win32.Zbot.arby virus can do?

  • Behavioural detection: Executable code extraction – unpacking
  • Yara rule detections observed from a process memory dump/dropped files/CAPE
  • Creates RWX memory
  • Possible date expiration check, exits too soon after checking local time
  • Dynamic (imported) function loading detected
  • Reads data out of its own binary image
  • The binary contains an unknown PE section name indicative of packing
  • Authenticode signature is invalid
  • Anomalous binary characteristics

How to determine Trojan-Spy.Win32.Zbot.arby?


File Info:

name: 9A6017AAB1F8D781C1C6.mlw
path: /opt/CAPEv2/storage/binaries/519f4a10245d6b4befca891f89060439b546279ea51f77544d9d62a53df1be33
crc32: 9301CB32
md5: 9a6017aab1f8d781c1c6a9767506e0bb
sha1: dd9393a4160fc6e372a6f3d306586265c5b9f3aa
sha256: 519f4a10245d6b4befca891f89060439b546279ea51f77544d9d62a53df1be33
sha512: 64041e5866cf662f8623e6dc7738b2041ae7015574cd5af59a6c427aade69e1115a25a7de2d424f5473a5d8e896b3699fc8881a68be8cd844be62b08ba67a745
ssdeep: 1536:Xq2U0QOI+vrmd6S9DX/Ou8K1idiV/VzgCJ:XnUJOIurmUSl/+9ditaQ
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T101C3F25B3C9515B9E7CF2D759AC724AADEB2BA01F37CC2108612126DCEB7380F82D524
sha3_384: 9acc4618783b0bc6cfd865c4321be950d1382600905c6524b96e0989e27f8acd6572534641262f33b6427e9339954b93
ep_bytes: 8d9fa5f1ff1a0f9bc266ba2b7ae96900
timestamp: 2005-06-10 14:32:02

Version Info:

CompanyName: †SOFTWIN숥盪ꝯ낵䆨쉓鏇
鹉듊逑꫐udde1䔿ઁ禕曠狖蠳澀ₔ됱薅뤞癧ude2c脸冗ẘ뉘⥬坰㮁㎓鞰로刨ꡂ꫹ꖽ癬䊴⼙Ẑ㹂仈㖲【㽴嗩☔끟㈵阊ཷ䫨䩫䎦↭鬫厂⨓꒳擮ꅾ댰ʖ૱ኡᄅ盪댔悉닰鿟䭄ⶕ瘱菩ᐴ犙偦溅倰ꚰ亪滸襎껦喌udda5ⱨ⏤ꎘ齍ኁ捛퉌憓udfe7䇧蟦쫔䜧⓶饹魜ಾ篁ꚮ쾺㱺㑔溃됨꓾숅ꈆ蒽ᨫ䂞ᅯ䯆⣱䳶ἣ삢㭈ё嶕厒鈚┆뫒黀䧥䠋ᔐ貋介퇥ꐜ땩툇펳ः䦥䝠ᩡ伩졀ﭳ䠚桩udea6骩酋谫⦮걝ʢ䷵쒿쫶찌㞱ꧣ赮䆁閕䆨ꄍ蘇酰뇽㨱鹅顶뭂潓醇ຐ刳韨❂ሀudcc3爥옕⼼Էᦄ엛덒몀ม适ѱ⠹柍鋥疫跄붆阜ꛮ劶ꛛ⹾빲玈훅⌸udf1fӫ埅䐱udf77兾랹槵畳ⶪ㒡诉뀃庯䏸ᨯ쳵媭䲾垚Ὡ樀੕搱鵣䙨墕휭먺䪷憲빉퍢ঌ둢Ყଡ嬯ᨛ횾둅㞃␪Ⓐꃎ㪇udd9dᵶ뗡쩛ꖖ歸쨾Ῐudff7ud99d톧籥챲뀆㸫鮾쾪᭡璖ꎤ䥎ꋢำꃘ麶ꘄ鋏ʢ稼盋燰䡕ຫ꥙uda98禟婒ⱛ鮛臻椫䣀៌혳䰓䦗晎⭸帯䩈륧ꈑ问ꐯ⒤剝䋺ﺪ⩚䠬຾殢숺ɓ䆵폷纫鯳:

Trojan-Spy.Win32.Zbot.arby also known as:

BkavW32.AIDetect.malware1
LionicTrojan.Win32.Zbot.l!c
Elasticmalicious (high confidence)
DrWebTrojan.PWS.Panda.487
MicroWorld-eScanTrojan.Brsecmon.1
FireEyeGeneric.mg.9a6017aab1f8d781
ALYacTrojan.Brsecmon.1
CylanceUnsafe
VIPRETrojan.Win32.Zbot.im (v)
SangforTrojan.Win32.Save.a
K7AntiVirusTrojan ( 005110401 )
AlibabaTrojanSpy:Win32/FakeAV.f8dba261
K7GWTrojan ( 005110401 )
Cybereasonmalicious.ab1f8d
BitDefenderThetaGen:NN.ZexaF.34212.h80@auUFMXfG
VirITTrojan.Win32.Panda.ST
CyrenW32/FakeAlert.OG.gen!Eldorado
SymantecML.Attribute.HighConfidence
ESET-NOD32Win32/Spy.Zbot.YW
TrendMicro-HouseCallTROJ_KRYPTK.SMM
ClamAVWin.Trojan.Zbot-12711
KasperskyTrojan-Spy.Win32.Zbot.arby
BitDefenderTrojan.Brsecmon.1
NANO-AntivirusVirus.Win32.Gen.ccmw
SUPERAntiSpywareTrojan.Agent/Gen-Backdoor[Softwin]
AvastWin32:MalOb-CK [Cryp]
TencentMalware.Win32.Gencirc.114de400
Ad-AwareTrojan.Brsecmon.1
EmsisoftTrojan.Brsecmon.1 (B)
ComodoMalware@#eyeiwuumemx9
ZillyaTrojan.Zbot.Win32.29869
TrendMicroTROJ_KRYPTK.SMM
McAfee-GW-EditionBehavesLike.Win32.Generic.ch
SophosMal/Generic-R + Troj/FakeAV-CQL
IkarusPacker.Win32.Krap
GDataTrojan.Brsecmon.1
JiangminTrojanSpy.Zbot.aott
Webrootw32.malware.gen
AviraTR/Crypt.XPACK.Gen2
MAXmalware (ai score=99)
Antiy-AVLTrojan/Generic.ASMalwS.27523C
ArcabitTrojan.Brsecmon.1
ViRobotTrojan.Win32.A.Zbot.123392.T
ZoneAlarmTrojan-Spy.Win32.Zbot.arby
MicrosoftPWS:Win32/Zbot
CynetMalicious (score: 100)
AhnLab-V3Trojan/Win32.Zbot.C160885
Acronissuspicious
McAfeeGeneric PWS.lv
TACHYONTrojan-Spy/W32.ZBot.123392.BX
VBA32Trojan.Zeus.EA.01000
MalwarebytesMalware.Heuristic.1003
APEXMalicious
RisingTrojan.Win32.Generic.12921D79 (C64:YzY0Ovt0SzezvTF4)
YandexTrojanSpy.Zbot!OtuIltG/3SE
SentinelOneStatic AI – Malicious PE
FortinetW32/Kryptik.AJ!tr
AVGWin32:MalOb-CK [Cryp]
PandaTrj/Genetic.gen
CrowdStrikewin/malicious_confidence_100% (D)

How to remove Trojan-Spy.Win32.Zbot.arby?

Trojan-Spy.Win32.Zbot.arby removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment