Spy • Trojan

Trojan-Spy.Zbot (file analysis)

Malware Removal

The Trojan-Spy.Zbot is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Trojan-Spy.Zbot virus can do?

  • At least one process apparently crashed during execution
  • Sample contains Overlay data
  • Authenticode signature is invalid
  • Anomalous binary characteristics

How to determine Trojan-Spy.Zbot?



File Info:

name: 5022DD95CFAC4F5874A3.mlw
path: /opt/CAPEv2/storage/binaries/a47a48ef0203d3f080582bdac95d028c92a2355081575be2684cbf34a1b3ffdb
crc32: 0182CF1B
md5: 5022dd95cfac4f5874a3821b10aa030e
sha1: 09e678aea07daaf73ea86dc85ca788a091d1f5d6
sha256: a47a48ef0203d3f080582bdac95d028c92a2355081575be2684cbf34a1b3ffdb
sha512: 3296c7e79b70485980604430ea6f23b91aa5765c50808a376200ee6b84a6c789541b31938e90d29acddab346bac94a40cb12ccb58dbea7c6b947c4b7fce0386c
ssdeep: 3072:kT/xWHc6ctpSFjrgZWcFOCprhFqYDWxf0J5nRKSX6D1GQL:Q/xaMIrQWc0C1hNhTZY
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1AF146C247BE0C473D5671A35087A97754A39BD201B749AC3B3843F6E6D702E1AB3A34B
sha3_384: 6a72f3871eade89030b1142c6e736496c379470135759d9652a51b75f6fcf551c4e9d838e56caaab00b69a7b0831834a
ep_bytes: 68fb074100e934060000e80f00000043
timestamp: 2011-10-18 18:27:15


Version Info:

Translation: 0x0409 0x04b0
CompanyName: Lavasoft
FileDescription: Ad-Aware Browsing Protection
FileVersion: 1, 0, 1, 31
LegalCopyright: Copyright (C) 2010 Lavasoft
ProductName: Ad-Aware Browsing Protection
ProductVersion: 1.0

Trojan-Spy.Zbot also known as:

BkavW32.PatchedZB.PE
DrWebTrojan.Starter.1695
MicroWorld-eScanTrojan.Patched.HE
FireEyeGeneric.mg.5022dd95cfac4f58
CAT-QuickHealW32.Patchload.O
McAfeeW32/Katusha
CylanceUnsafe
ZillyaTrojan.Patched.Win32.73909
K7AntiVirusTrojan ( 0026f5d91 )
K7GWTrojan ( 0026f5d91 )
Cybereasonmalicious.5cfac4
VirITWin32.Yoshi.E
CyrenW32/Patched.G
SymantecTrojan.Paccyn!inf
Elasticmalicious (high confidence)
ESET-NOD32Win32/Patched.HN
TrendMicro-HouseCallPTCH_KATUSHA.W
ClamAVWin.Trojan.Patched-143
KasperskyTrojan.Win32.Patched.mf
BitDefenderTrojan.Patched.HE
NANO-AntivirusTrojan.Win32.Patched.dwgwe
AvastWin32:Patched-WQ [Trj]
TencentVirus.Win32.Patched.mf
Ad-AwareTrojan.Patched.HE
EmsisoftTrojan.Patched.HE (B)
ComodoTrojWare.Win32.Patched.HN@3bsert
BaiduWin32.Virus.Loader.l
VIPRETrojan.Patched.HE
TrendMicroPTCH_KATUSHA.W
McAfee-GW-EditionW32/Katusha
SophosW32/Patched-AL
IkarusVirus.Win32.Patchload
GDataTrojan.Patched.HE
JiangminTrojanSpy.Zbot.adxr
AviraW32/Patchload.A
Antiy-AVLTrojan/Generic.ASVirus.2BD
ArcabitTrojan.Patched.HE
ViRobotWin32.Patched.BE
MicrosoftVirus:Win32/Patchload.O
CynetMalicious (score: 100)
AhnLab-V3Win-Trojan/Patched.DD
VBA32Trojan-Spy.Zbot.gen
ALYacTrojan.Patched.HE
TACHYONVirus/W32.Patched.Gen
MalwarebytesMalware.AI.471752596
APEXMalicious
RisingVirus.Loader!1.9B09 (CLASSIC)
YandexWin32.Katusha.Gen
MAXmalware (ai score=83)
MaxSecureVirus.W32.Patched.MF
FortinetW32/Patched.MF!tr
AVGWin32:Patched-WQ [Trj]
PandaW32/Katusha.BN
CrowdStrikewin/malicious_confidence_90% (W)

How to remove Trojan-Spy.Zbot?

Trojan-Spy.Zbot removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment