Trojan.Zbot.IMC (file analysis)

The Trojan.Zbot.IMC is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan.Zbot.IMC virus can do?

At least one process apparently crashed during execution
Yara rule detections observed from a process memory dump/dropped files/CAPE
Authenticode signature is invalid

How to determine Trojan.Zbot.IMC?


File Info:
name: 0E8D62C325AEF6BCEA9A.mlw
path: /opt/CAPEv2/storage/binaries/d8d99e2ba19d47af63bcf9d839e4934bebfda8beacbaa4ee59e414cb86fb5872
crc32: B5DCF947
md5: 0e8d62c325aef6bcea9a2ccc2a892644
sha1: d6ecf0a50bd3f9f91df651a7b4b077c519de769e
sha256: d8d99e2ba19d47af63bcf9d839e4934bebfda8beacbaa4ee59e414cb86fb5872
sha512: 140cb21ec15030dcb4075bd1e06fbf759cc810ed074fccbe2ef91e01d9d9a1430c65cbfc151dc3d870245d2567ba9fbbb4801513b2091c124d2d297ec3835c0a
ssdeep: 6144:U1WTBJQhLA/iH6+Pggv7tVjzLDc8VhUDnKiX6qodeNHP2L8:U1WTrQhLL9gQtF/c8Vhm8Jiv2L
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T18744CF11F68449F7FDB361B05866772ADABBE51443188DE3E3E4AFA22801191B72D3C7
sha3_384: e5303642ae48ac5e76990a60c2ba6bd9c9170df4bdb58b7782643e9ea0659879f231097382f3ec7741be7f4637afba95
ep_bytes: 558bec51535633f633c946e817f5ffff
timestamp: 2014-09-04 11:23:15

Version Info:
0: [No Data]

Trojan.Zbot.IMC also known as:

Bkav	W32.AIDetect.malware1
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
FireEye	Generic.mg.0e8d62c325aef6bc
CAT-QuickHeal	Trojanpws.Zbot.7337
ALYac	Trojan.Zbot.IMC
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 004aea031 )
K7GW	Trojan ( 004aea031 )
CrowdStrike	win/malicious_confidence_90% (D)
Cyren	W32/FakeAlert.FY.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
ClamAV	Win.Trojan.Zbot-64722
Kaspersky	HEUR:Exploit.Win32.ShellCode.vho
BitDefender	Trojan.Zbot.IMC
MicroWorld-eScan	Trojan.Zbot.IMC
Avast	Sf:Injector-G [Trj]
Ad-Aware	Trojan.Zbot.IMC
Emsisoft	Trojan.Zbot.IMC (B)
DrWeb	Trojan.PWS.Panda.5676
VIPRE	Trojan.Win32.Zbot.hzx (v)
TrendMicro	Cryp_Xin1
McAfee-GW-Edition	BehavesLike.Win32.ZBot.dh
Sophos	ML/PE-A + Mal/Behav-010
Ikarus	Trojan-PWS.Win32.Zbot
GData	Win32.Trojan-Spy.Zbot.CL
Avira	TR/Spy.Gen
Microsoft	PWS:Win32/Zbot!GOA
AhnLab-V3	Backdoor/Win32.Necurs.R121059
Acronis	suspicious
McAfee	PWS-Zbot.gen.apr
MAX	malware (ai score=83)
Malwarebytes	Malware.AI.1106844228
TrendMicro-HouseCall	Cryp_Xin1
Rising	Malware.Heuristic!ET#100% (RDMK:cmRtazr22X6E0T1jaV9CkvTX0bK9)
Yandex	Trojan.GenAsa!wbBez+nKmyk
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/Zbot.AAU!tr
BitDefenderTheta	AI:Packer.6EDAB0D41E
AVG	Sf:Injector-G [Trj]
Cybereason	malicious.325aef
Panda	Trj/Genetic.gen

How to remove Trojan.Zbot.IMC?

Trojan.Zbot.IMC removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X