What is “Trojan.Spy.Zbot”?

The Trojan.Spy.Zbot is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.Spy.Zbot virus can do?

• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Enumerates running processes
• Expresses interest in specific running processes
• CAPE extracted potentially suspicious content
• Unconventionial language used in binary resources: Russian
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• The executable is compressed using UPX
• Authenticode signature is invalid
• Code injection with CreateRemoteThread in a remote process
• Behavioural detection: Injection (inter-process)
• Behavioural detection: Injection with CreateRemoteThread in a remote process

How to determine Trojan.Spy.Zbot?

File Info:
name: B1EC46F0CE0ADAD8177E.mlw
path: /opt/CAPEv2/storage/binaries/1725e1ceeceaaf61ff7423b3052ec2890a47e0121b44baf9ec6cc0df6a5db2d2
crc32: EE59E83E
md5: b1ec46f0ce0adad8177ea93d920a2f72
sha1: 80a2e2762bc0f4b5094a3b9bd4c0b6100de0176f
sha256: 1725e1ceeceaaf61ff7423b3052ec2890a47e0121b44baf9ec6cc0df6a5db2d2
sha512: fecafeae7608a3e46eaaddb13c77a5dcaeaf024a138a99be40e365fb462f34e0f3bf1ffd7c7e972d03ef1b84eceffb9820d46979aa961fe78b6381818caf7255
ssdeep: 3072:a+VdGx8MKVVBeUFyZBLUmOG8/2Iu7F8KYH9zq:a+VgyZVrPyZBngeIALe9
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1E3A312770102F9CECC5179757AD12501EE38B0C7BB702FEDAE0FA2F58780665A32995A
sha3_384: 4397806ef6b0f41072c74d5007931008f89d78f6e767a7bb0c018e2866ecc147421394b9559d160e0280b043d3e48a44
ep_bytes: 833c24fe77fe8d6424cc6087f383ecdc
timestamp: 2006-04-19 09:29:34

Version Info:
0: [No Data]

Trojan.Spy.Zbot also known as:

How to remove Trojan.Spy.Zbot?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.