What is “Trojan-Spy.Win32.Zbot.bfok”?

The Trojan-Spy.Win32.Zbot.bfok is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan-Spy.Win32.Zbot.bfok virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Possible date expiration check, exits too soon after checking local time
• Dynamic (imported) function loading detected
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Unconventionial language used in binary resources: Russian
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• The executable is compressed using UPX
• Authenticode signature is invalid

How to determine Trojan-Spy.Win32.Zbot.bfok?

File Info:
name: C8DD66AE05C705676AED.mlw
path: /opt/CAPEv2/storage/binaries/5896a7165eebc3b744c7ba85919870fe3aa78959479188d97a31bcce9ae37e94
crc32: 5ED3BBC4
md5: c8dd66ae05c705676aed1caa88b3afdb
sha1: b93c0e4aa98a1783415509daf035d6123377dedc
sha256: 5896a7165eebc3b744c7ba85919870fe3aa78959479188d97a31bcce9ae37e94
sha512: 8aa045aa2d9c58a8ffd67578460e9cb68c7e41f61943a4994cc1509555745d6556045b094566200a7fc4b7ca7a0bf4b211d98b40bf00c3c9745dc78a72023620
ssdeep: 3072:ZjbkeanQ4spU8rfUjo3sP6MpeRMMG3Iv2juVIdyraCNWR1:+ean5ojOoDMpAMHwFIErzN2
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T18CD3022BF7852C71EBEC2476A2C6193DE3A077B9DBB45023997D2F4540A678323E0685
sha3_384: 877091dd8ed5c03657cfca98c74c9dcae06fb27d4d44f1ce37e1b10e91bdefcfc9970386b9e4b33108e8171e303b7e82
ep_bytes: 60be150072008dbeeb0fceff5783cdff
timestamp: 2008-12-28 17:14:57

Version Info:
CompanyName: Qwwyvukm Gruocu
FileDescription: Qwwyvukm Exgtjvu Hdiilgqt
FileVersion: 122, 27, 43, 114
InternalName: Qwwyvukm
LegalCopyright: Copyright © Qwwyvukm Gruocu 2003-2011
OriginalFilename: Qwwyvukm.exe
ProductName: Qwwyvukm Exgtjvu Hdiilgqt
ProductVersion: 45, 71, 43, 123
Translation: 0x0409 0x04e4

Trojan-Spy.Win32.Zbot.bfok also known as:

How to remove Trojan-Spy.Win32.Zbot.bfok?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.