Trojan

What is “Trojan:Win32/Zapchast.MB!MTB”?

Malware Removal

The Trojan:Win32/Zapchast.MB!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Trojan:Win32/Zapchast.MB!MTB virus can do?

  • SetUnhandledExceptionFilter detected (possible anti-debug)
  • Dynamic (imported) function loading detected
  • HTTPS urls from behavior.
  • Unconventionial language used in binary resources: Arabic (Oman)
  • The binary contains an unknown PE section name indicative of packing
  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid

How to determine Trojan:Win32/Zapchast.MB!MTB?



File Info:

name: 22565F98B4A04E44095D.mlw
path: /opt/CAPEv2/storage/binaries/21a5ef2b75f30e4294534f75244b7ea7a4622b1709b86a95a050997d4dbb78d8
crc32: FEDA8954
md5: 22565f98b4a04e44095d3333a1cd46d4
sha1: 54f4fe4bf20a1cc3802dcddb508ec74ce1a7a7ed
sha256: 21a5ef2b75f30e4294534f75244b7ea7a4622b1709b86a95a050997d4dbb78d8
sha512: 4c141c0909fd1c67018d9e604aa314515c60ad19ff330076d6a6417d1976fc851f515994d3bcbd54b156b10545c4f4bd684452a5b3a5cae52c389143238561e7
ssdeep: 12288:/xnwIjmTbpHpW9AjG+gePWG+4saCuRXeyR8W6szcwG67S+9Gf1NyKDaV:pwDjjngeBsVQ8W3zLG6G+4f9DM
type: PE32 executable (console) Intel 80386, for MS Windows
tlsh: T1A1D4BF82F790C8F2D26B573E246697361F3DE8154B05CEDBF3A41D14EE206E259326CA
sha3_384: 5950e9c477194f33a367b9d6fde44d7c92259126e07a3cd848c00238a0b49b322ee6ae2b6932e16ed0c73cb166350775
ep_bytes: e847050000e974feffff3b0d14204500
timestamp: 2021-11-20 12:40:56


Version Info:

CompanyName: AnyDoc
FileDescription: AnyDoc
FileVersion: 1.3.1.3
InternalName: AnyDoc.exe
LegalCopyright: Hex-Rays SA
OriginalFilename: AnyDoc.exe
ProductName: AnyDoc
ProductVersion: 1.3.1.3
Translation: 0x041f 0x04b0

Trojan:Win32/Zapchast.MB!MTB also known as:

BkavW32.AIDetect.malware2
LionicTrojan.Win32.Zapchast.4!c
Elasticmalicious (high confidence)
MicroWorld-eScanTrojan.GenericKDZ.81157
FireEyeGeneric.mg.22565f98b4a04e44
CAT-QuickHealTrojan.ZapchastRI.S25215892
McAfeeGenericRXQY-KC!22565F98B4A0
CylanceUnsafe
ZillyaDownloader.Agent.Win32.455704
SangforTrojan.Win32.Zapchast.gen
K7AntiVirusTrojan-Downloader ( 0058a7cc1 )
AlibabaTrojanDownloader:Win32/Zapchast.0cf1f958
K7GWTrojan-Downloader ( 0058a7cc1 )
BitDefenderThetaGen:NN.ZexaF.34084.Nu0@aSJHdXgO
SymantecML.Attribute.HighConfidence
ESET-NOD32a variant of Win32/TrojanDownloader.Agent.FZK
TrendMicro-HouseCallTROJ_GEN.R002C0WL221
Paloaltogeneric.ml
KasperskyHEUR:Trojan.Win32.Zapchast.gen
BitDefenderTrojan.GenericKDZ.81157
AvastWin32:DropperX-gen [Drp]
TencentMalware.Win32.Gencirc.10cf9052
Ad-AwareTrojan.GenericKDZ.81157
EmsisoftTrojan.GenericKDZ.81157 (B)
DrWebTrojan.PWS.Stealer.31727
TrendMicroTROJ_GEN.R002C0WL221
McAfee-GW-EditionBehavesLike.Win32.Generic.jc
SophosMal/Generic-S
IkarusTrojan-Downloader.Win32.Agent
GDataTrojan.GenericKDZ.81157
JiangminTrojan.Zapchast.adx
AviraTR/Crypt.XPACK.Gen7
MAXmalware (ai score=81)
Antiy-AVLTrojan/Generic.ASMalwS.34DCB1E
GridinsoftRansom.Win32.Sabsik.sa
ArcabitTrojan.Generic.D13D05
APEXMalicious
MicrosoftTrojan:Win32/Zapchast.MB!MTB
CynetMalicious (score: 100)
AhnLab-V3Trojan/Win.Generic.R456588
VBA32BScope.Backdoor.Mokes
ALYacTrojan.GenericKDZ.81157
MalwarebytesTrojan.Downloader
YandexTrojan.Zapchast!4Wy58wB6I4o
SentinelOneStatic AI – Suspicious PE
FortinetW32/Agent.FZK!tr.dldr
AVGWin32:DropperX-gen [Drp]
PandaTrj/GdSda.A
CrowdStrikewin/malicious_confidence_100% (W)

How to remove Trojan:Win32/Zapchast.MB!MTB?

Trojan:Win32/Zapchast.MB!MTB removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment