What is “Trojan-Spy.Win32.Zbot.udaz”?

The Trojan-Spy.Win32.Zbot.udaz is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan-Spy.Win32.Zbot.udaz virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Possible date expiration check, exits too soon after checking local time
• Dynamic (imported) function loading detected
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Unconventionial language used in binary resources: Russian
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• The executable is compressed using UPX
• Authenticode signature is invalid

How to determine Trojan-Spy.Win32.Zbot.udaz?

File Info:
name: 46EA44996AA9CAF332AB.mlw
path: /opt/CAPEv2/storage/binaries/f06563baaf965a8535e72bef1cdc310f158c2a1d97c9e656ee57dfd612641413
crc32: 7C28811A
md5: 46ea44996aa9caf332ab03db502aee19
sha1: 04b6cc91c8104d5c2bed72b4bc18f4f02fc96ab9
sha256: f06563baaf965a8535e72bef1cdc310f158c2a1d97c9e656ee57dfd612641413
sha512: 52ae20d8602aafa1176dc0d67f632952049e7b7913c83d31112302638aca4f3978354b3683e3dde3d8ccf77bd05e150bc6bd2c99b4ca6bbf978e3213e58ee3e4
ssdeep: 3072:9qOf6u/T+nE5YkXWmb6o5nGUNOqMeOQDl/5vvnYbI+YedF:RCu7q6Wm2o5N1MyhRvPYz
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1EBD312CA3F70978AD9BF00B168ED3B2146A4F938018AEFAF188D4369747B546D5F2158
sha3_384: 77c87f3f83ba1e6d68931442d1f67e8e878de8d17ee2410ae754b3fdf76f8094efca56dcf426bc127729ce9186405eb4
ep_bytes: 60be159042008dbeeb7ffdff57eb0b90
timestamp: 2007-04-06 04:36:02

Version Info:
CompanyName: Xxjhtkqkgv Xasot
FileDescription: Xxjhtkqkgv Lvlacym Vicghcj
FileVersion: 6, 108, 9, 76
InternalName: Xxjhtkqkgv
LegalCopyright: Copyright © Xxjhtkqkgv Xasot 2001-2009
OriginalFilename: Xxjhtkqkgv.exe
ProductName: Xxjhtkqkgv Lvlacym Vicghcj
ProductVersion: 33, 75, 24, 95
Translation: 0x0409 0x04e4

Trojan-Spy.Win32.Zbot.udaz also known as:

How to remove Trojan-Spy.Win32.Zbot.udaz?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.