Trojan.Zeus.EA.0999 malicious file

The Trojan.Zeus.EA.0999 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.Zeus.EA.0999 virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Dynamic (imported) function loading detected
• Enumerates running processes
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• Unconventionial language used in binary resources: Russian
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• The executable is compressed using UPX
• Authenticode signature is invalid
• Created a process from a suspicious location
• Creates a copy of itself

How to determine Trojan.Zeus.EA.0999?

File Info:
name: 7458421B1930FD0689AB.mlw
path: /opt/CAPEv2/storage/binaries/f372d8ac4b190b1079120513f04e10f1306c60aa4a2861b679c47a66884963b5
crc32: 57347450
md5: 7458421b1930fd0689abd0f4c8506bdc
sha1: 75913d1e4d9fd8c2736fc5101430c60d44022e12
sha256: f372d8ac4b190b1079120513f04e10f1306c60aa4a2861b679c47a66884963b5
sha512: bb6e278ca57515df25a6b0fa7f95b93150328ef2f3330e1822514a57fdbaa4b5e416b16987c57af18e2216d53e5fbab0428dd226661bfe417bad80ce431ad409
ssdeep: 196608:rn5fbutnKAt5gdnlp2oZVCZJxUg+XQVm8lA:rn5fa8At5Il3QKg+XQVk
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T10B66332FE86E9889CD839AFDDFBF5252650DCE065DD0AD55AAC0074B680B6D03F18EC1
sha3_384: ead78777138ef9562adc6c077044393d1716931c6aa0b4e1c13c4dca1b9c4ef3629ad0f5399eb01cf023a4b77fe28b94
ep_bytes: 60be00504a008dbe00c0f5ff57eb0b90
timestamp: 2005-05-17 14:15:44

Version Info:
CompanyName: Kawetyl Osclmswfb
FileDescription: Kawetyl Ugntspq Rywhbps
FileVersion: 52,71,79,88
InternalName: Kawetyl
LegalCopyright: Copyright © Kawetyl Osclmswfb 2004-2007
OriginalFilename: Kawetyl.exe
ProductName: Kawetyl Ugntspq Rywhbps
ProductVersion: 95,17,57,80
Translation: 0x0409 0x04e4

Trojan.Zeus.EA.0999 also known as:

How to remove Trojan.Zeus.EA.0999?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.