Trojan.Spy.Zbot.FOF information

The Trojan.Spy.Zbot.FOF is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.Spy.Zbot.FOF virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Sample contains Overlay data
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Unconventionial language used in binary resources: Russian
• The binary contains an unknown PE section name indicative of packing
• Authenticode signature is invalid
• Attempts to identify installed AV products by registry key

How to determine Trojan.Spy.Zbot.FOF?

File Info:
name: 2D4C75703EA65FCD8E37.mlw
path: /opt/CAPEv2/storage/binaries/fafb7422f7f6d577030d7c12d91142914734137e283ff76df336be3989dde348
crc32: D9872F76
md5: 2d4c75703ea65fcd8e37df1db25aa862
sha1: 0a621e31b72320ba367bad9cbc3ff8bf0ca11583
sha256: fafb7422f7f6d577030d7c12d91142914734137e283ff76df336be3989dde348
sha512: 33e3b9cb30fd45560a806bea721f642c5c9cf5b8739d7e6222053f57ab4fa8791d2e70772face5d27b17aed240657d74d8bc12a033a2e0b45f3fc7466dbc6440
ssdeep: 6144:KsXeMUkYZkDX+ii/JvvD3b+e3tWnOahz7ms48BhvCO:pOzksk74Bv7rdOFM8T
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1A154123B3092B687EFD589B2161290EC9B85DB62119F978F0CC80F1ADD53256CB325DE
sha3_384: ae5ca9b45ed219d6b92f565bed16146f90d13a1297fdf4854e151693a2f2aa163211a861900ff67b11fc774751df685c
ep_bytes: 558bec6aff68a0ab400068908d400064
timestamp: 1992-06-08 07:06:30

Version Info:
Comments: LazUI
CompanyName: Carbonite, Inc.
FileDescription: cANlue
FileVersion: 55, 0, 0, 3
InternalName: AGZD
LegalCopyright: Copyright © 2017
LegalTrademarks: 
OriginalFilename: inaViH6 dljGIo
PrivateBuild: 
ProductName: oo5LYnJY E0L
ProductVersion: 3, 0, 0, 22
SpecialBuild: 

Trojan.Spy.Zbot.FOF also known as:

How to remove Trojan.Spy.Zbot.FOF?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.