Trojan:Win32/Qakbot!pz (file analysis)

The Trojan:Win32/Qakbot!pz is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan:Win32/Qakbot!pz virus can do?

• Sample contains Overlay data
• Reads data out of its own binary image
• The binary contains an unknown PE section name indicative of packing
• Authenticode signature is invalid
• Touches a file containing cookies, possibly for information gathering

How to determine Trojan:Win32/Qakbot!pz?

File Info:
name: 8CB95F6FE93DA8DF39C5.mlw
path: /opt/CAPEv2/storage/binaries/2bc64892f3f0efbebf0f512a378d4fa933dbe67779b8dfc7c4d4e1ffcbe2ee41
crc32: 3372D210
md5: 8cb95f6fe93da8df39c5b818452ab652
sha1: 7acdc3cd1fa3dfdb03ab4a29eab704c7b13affc4
sha256: 2bc64892f3f0efbebf0f512a378d4fa933dbe67779b8dfc7c4d4e1ffcbe2ee41
sha512: 69596c4c54489cde682d3b01dccf6718497c8d0e948e9f0a27b3a82aeefefc46be56667271e4524f33990d50e704f66b1368d432ca3ac12c63e5d61236e05c6f
ssdeep: 98304:6cao0n+b7BmQkZBzytDbIC5AwQqZUha5jtSyZIUb:6l+XBmQkZ8tDbIUJQbaZtli
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T111869D01EBF8DE1ED5BF0775A8B221118BF5F8D1DB53DB9E6900B0AD7A923406942363
sha3_384: 1c24233ecc0a8c3322ff7ed06b1433467f8678c94caf1c18f3d7267b08c342b4bd4e033561e645c60c07651a4f011d6d
ep_bytes: e868050000e988feffff3b0d58254300
timestamp: 2021-03-05 21:34:22

Version Info:
0: [No Data]

Trojan:Win32/Qakbot!pz also known as:

How to remove Trojan:Win32/Qakbot!pz?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.