Trojan-Spy.Win32.Zbot.thog malicious file

The Trojan-Spy.Win32.Zbot.thog is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan-Spy.Win32.Zbot.thog virus can do?

• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Possible date expiration check, exits too soon after checking local time
• Anomalous file deletion behavior detected (10+)
• Dynamic (imported) function loading detected
• Reads data out of its own binary image
• A process created a hidden window
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• Authenticode signature is invalid
• Created a process from a suspicious location

How to determine Trojan-Spy.Win32.Zbot.thog?

File Info:
name: D5F9DC557E47F9DAA93D.mlw
path: /opt/CAPEv2/storage/binaries/cec672c69221c6efc44de866d80462ac303ca558ee4ea6aa9e7747f085384954
crc32: 1605A18C
md5: d5f9dc557e47f9daa93dba24b685ef8b
sha1: 970e8ab15b5e52685a6cd51b9aeaf6c6012380c7
sha256: cec672c69221c6efc44de866d80462ac303ca558ee4ea6aa9e7747f085384954
sha512: 27befcf1898b12cb5517c4d4644eb85969023a205e245d673a05782e8760088c2fd8920c3da3017feac343e245bf2f9d2b57b4c9ea3141983e375ebaca505912
ssdeep: 768:/V/6Ca2Xu/iiSOb0LJ6U4FolF+FgMnjCQ2tJ49F+neCqTiHEXdX2e5344524444i:/4Cd+qitb0bt+FTCQ2w9EuTiHsdXzN6q
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1E7435A167AC1C471C41780B508B7C78E7B27BB611A6E83BF378A134A9E727D1693E309
sha3_384: b8a795999639ab3c6034a52fea9a1c552bd4e80d77b5f6c33b3649511370f8defbba16da29162ca6c999e03fc1716967
ep_bytes: e85f140000e917feffffe8a3040000ff
timestamp: 2014-05-14 06:15:51

Version Info:
0: [No Data]

Trojan-Spy.Win32.Zbot.thog also known as:

How to remove Trojan-Spy.Win32.Zbot.thog?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.