Trojan-Spy.Win32.Zbot.rtmr information

The Trojan-Spy.Win32.Zbot.rtmr is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan-Spy.Win32.Zbot.rtmr virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Possible date expiration check, exits too soon after checking local time
• Loads a driver
• Dynamic (imported) function loading detected
• Enumerates running processes
• Expresses interest in specific running processes
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Authenticode signature is invalid
• Uses Windows utilities for basic functionality
• Code injection with CreateRemoteThread in a remote process
• Attempts to restart the guest VM
• Behavioural detection: Injection (inter-process)
• Behavioural detection: Injection with CreateRemoteThread in a remote process
• Tries to unhook or modify Windows functions monitored by Cuckoo
• Modifies boot configuration settings
• Collects and encrypts information about the computer likely to send to C2 server
• Installs itself for autorun at Windows startup
• Installs itself for autorun at Windows startup
• Creates a hidden or system file
• Collects information to fingerprint the system
• Uses suspicious command line tools or Windows utilities

How to determine Trojan-Spy.Win32.Zbot.rtmr?

File Info:
name: AE12474B13BEEA8FD984.mlw
path: /opt/CAPEv2/storage/binaries/39b5c513bf6c1280676e075e069763a1c7f1d8e74439d0b07661cbeed050a102
crc32: 02243490
md5: ae12474b13beea8fd9845da9d14534cd
sha1: 5a2ab9e0702f3591b2e274cd5153563c4b5ee414
sha256: 39b5c513bf6c1280676e075e069763a1c7f1d8e74439d0b07661cbeed050a102
sha512: eb4731ffb72700e1bf1e171393a3a32cd58c209d98058ef30fe2ed86554a8572a50d964d15fb7bc2577346ae7e115b74e7d5434959aba8fa2570797b8ffbded8
ssdeep: 12288:Fua7bZpbK4akBwY/73L0pOlziHxr+xd0tKlPgfVUknRLhp1:VVpO4TBwe770GWIq
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T19BE48CE87810A13FFB47293EA852DC5B164ABF4CAC94F6E73AE04F5B6C175038265478
sha3_384: 63f342cd8cbed63749e970be63d2c7645e4a92a4855993aeadddae2eee499a2025d560a67489587df754b3cb1d5c81c9
ep_bytes: e8f52c0000e917feffffcccccccccccc
timestamp: 2014-03-12 14:32:05

Version Info:
CompanyName: HEALTHCAREfirst
FileDescription: Mattertube
FileVersion: 2.7.430.643
InternalName: batindicate.exe
LegalCopyright: Copyright © 2010 HEALTHCAREfirst Corporation. All rights reserved.
OriginalFilename: batindicate.exe
ProductName: Mattertube HEALTHCAREfirst Are
Translation: 0x0409 0x04b0

Trojan-Spy.Win32.Zbot.rtmr also known as:

How to remove Trojan-Spy.Win32.Zbot.rtmr?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.