TrojanBNK.Zbot.mue (file analysis)

The TrojanBNK.Zbot.mue is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What TrojanBNK.Zbot.mue virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Possible date expiration check, exits too soon after checking local time
• Dynamic (imported) function loading detected
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Unconventionial language used in binary resources: Russian
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• The executable is compressed using UPX
• Authenticode signature is invalid

How to determine TrojanBNK.Zbot.mue?

File Info:
name: 8BC6A95B1AE14235357A.mlw
path: /opt/CAPEv2/storage/binaries/411bd7d6c2a8f1dcb29c2e8a8e476c04b2d0f6c6b75371b9d6942894fcd8cb44
crc32: FBA3D9C3
md5: 8bc6a95b1ae14235357ab87a733f4ddb
sha1: e48692c6f9f92b76d869a0d05effae987ce7dc8c
sha256: 411bd7d6c2a8f1dcb29c2e8a8e476c04b2d0f6c6b75371b9d6942894fcd8cb44
sha512: ebc399433ac21f1f00a3d915d767465ee37be71b55c2bd08eaca4c7e83ddce05f2c88dd73e407d4492d14c25bdcb3578ee8d5af038d5a130a095604d011fbfd7
ssdeep: 3072:huxnEJt4yjyiLB0NklbN6UgUXJZE69UYCuQ:huFEYyjF0NEB6U95ZEmUgQ
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T131D31346FB965C1ED16F8BBFD4731D3A16384005AF2FC90B0038221F93A053BDA2AE52
sha3_384: ee9c117b2a38ddc400b305e12643485d88df960f5ff6020578fb3727d982b83b453e8fb30234938bd10f8d3d710fa6a9
ep_bytes: 60be155044008dbeebbffbff5783cdff
timestamp: 2004-11-16 16:05:52

Version Info:
0: [No Data]

TrojanBNK.Zbot.mue also known as:

How to remove TrojanBNK.Zbot.mue?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.