About “Trojan.Spy.Zbot.ETG” infection

The Trojan.Spy.Zbot.ETG is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.Spy.Zbot.ETG virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• At least one process apparently crashed during execution
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Mimics the system’s user agent string for its own requests
• Possible date expiration check, exits too soon after checking local time
• Dynamic (imported) function loading detected
• At least one IP Address, Domain, or File Name was found in a crypto call
• Performs HTTP requests potentially not found in PCAP.
• Starts servers listening on 0.0.0.0:28075, :0
• Enumerates running processes
• Expresses interest in specific running processes
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• Authenticode signature is invalid
• Code injection with CreateRemoteThread in a remote process
• Behavioural detection: Injection (inter-process)
• Behavioural detection: Injection with CreateRemoteThread in a remote process
• Collects and encrypts information about the computer likely to send to C2 server
• Installs itself for autorun at Windows startup
• Attempts to modify proxy settings
• Collects information to fingerprint the system

How to determine Trojan.Spy.Zbot.ETG?

File Info:
name: A223F3EFD2B716E5C751.mlw
path: /opt/CAPEv2/storage/binaries/4d259c5e396fe5be9debcf933ab6a1c64b62c27cbe8a01ac6d96c60be917086e
crc32: A72CDEBA
md5: a223f3efd2b716e5c7513ffb15ebdcff
sha1: b9dd41a828db9ad7211cb478443b78a535c4b6b7
sha256: 4d259c5e396fe5be9debcf933ab6a1c64b62c27cbe8a01ac6d96c60be917086e
sha512: d81c7b934d3e7f229605709659abd75a1cbe2640ff910bf1ee8d1bd98a3344224451dc412c53322bf0de8e9f186d3473b099c7271458a57ab864cdfccaf23d1c
ssdeep: 3072:bB4FJbDTw6EVSp0ydsKA/QcbM7f5CGg4IlT6DA5a/c2AHJyWza9q4iuOneRLaZmw:bBqbDs6asUlWDA5F2Cyt9DGeRLaZmqs8
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T198049D6675E051B2D0F31BB0AE79731565BBBC245638CA4FD3108C5E6C72E81E93AB0B
sha3_384: ce3ff581e868762bcd99fcd046c019b888c36d515923eb8279ff5df95a31fd6c0ea62f4bb80dbe0e189ff4f477622a09
ep_bytes: 558bec83ec105333c932dbe834eeffff
timestamp: 2011-07-09 15:02:30

Version Info:
0: [No Data]

Trojan.Spy.Zbot.ETG also known as:

How to remove Trojan.Spy.Zbot.ETG?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.