Trojan-Spy.Win32.Zbot.uczz information

The Trojan-Spy.Win32.Zbot.uczz is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan-Spy.Win32.Zbot.uczz virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Possible date expiration check, exits too soon after checking local time
• Dynamic (imported) function loading detected
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Unconventionial language used in binary resources: Russian
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• The executable is compressed using UPX
• Authenticode signature is invalid

How to determine Trojan-Spy.Win32.Zbot.uczz?

File Info:
name: 445A2CAB4599F7C95F67.mlw
path: /opt/CAPEv2/storage/binaries/97ab3192642af09395c2d27093201aeb096948c122964ff258f0c3e1c95e9fb6
crc32: 94EEE15A
md5: 445a2cab4599f7c95f67ff93d71ccf35
sha1: adc52b58293a96f708e7c2ed160c952418dc47bd
sha256: 97ab3192642af09395c2d27093201aeb096948c122964ff258f0c3e1c95e9fb6
sha512: a913447162157ddf603acb069735919b0526c0fb46d015259ed07feb78f76029f646f9247f9d84ccdbd3bb88a8e3364bbbe9345cdfc393ea06cb897d51032803
ssdeep: 3072:9qOf6u/T+nE5YkXWmb6o5nGUNOqMeOQDl/5vvnYbI+YB6ydF:RCu7q6Wm2o5N1MyhRvPY3i
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1CAD312CA3F70974AD9BF007128ED3B3146A4FA38054ADFAF188D436960BB656D5F215C
sha3_384: 06512e6daa9e762ca25d3bf56f24bc066b85d6327e2fb8a9664049ef414fcbce0b5258bae769fa0346b24a45418b9142
ep_bytes: 60be159042008dbeeb7ffdff57eb0b90
timestamp: 2007-04-06 04:36:02

Version Info:
CompanyName: Xxjhtkqkgv Xasot
FileDescription: Xxjhtkqkgv Lvlacym Vicghcj
FileVersion: 6, 108, 9, 76
InternalName: Xxjhtkqkgv
LegalCopyright: Copyright © Xxjhtkqkgv Xasot 2001-2009
OriginalFilename: Xxjhtkqkgv.exe
ProductName: Xxjhtkqkgv Lvlacym Vicghcj
ProductVersion: 33, 75, 24, 95
Translation: 0x0409 0x04e4

Trojan-Spy.Win32.Zbot.uczz also known as:

How to remove Trojan-Spy.Win32.Zbot.uczz?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.