Categories: Trojan

Should I remove “Trojan:Win32/Zbot.GWW!MTB”?

The Trojan:Win32/Zbot.GWW!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan:Win32/Zbot.GWW!MTB virus can do?

Yara rule detections observed from a process memory dump/dropped files/CAPE
Possible date expiration check, exits too soon after checking local time
Reads data out of its own binary image
Authenticode signature is invalid

How to determine Trojan:Win32/Zbot.GWW!MTB?


File Info:
name: 43CA41D099979156A045.mlwpath: /opt/CAPEv2/storage/binaries/dafc0869d078f536cade80b89a42d0cf77e1bc00571ee525c2a196eb128ab7abcrc32: CF6A6E1Dmd5: 43ca41d099979156a0451c8cc33a427fsha1: db28ab922d5b4bb657de854fd2bb604e152be2d2sha256: dafc0869d078f536cade80b89a42d0cf77e1bc00571ee525c2a196eb128ab7absha512: 53aac29d29443e54cc5abd6199afde6bd6ef65a50a033c0977a5c4de01f3b2fe7c96e4647d2249adde3734aca34ae137e2cbb6bcf8fa83b0b176ea5ee5a03410ssdeep: 3072:fXTbKUxGLvhc9xuS4G1XHfYVATQkGrrshzNjPZD3d4BBnDyLi+Ky+PgfbpQO:fXTbKdLcx14G1XHgVU3G8JNZ3d4BnDyttype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T179E3BF76FDC411F1EEA73570896AB20BB6EBE91C23188DC3E3D80E466471251B56D3CAsha3_384: 782fc6f2bd48f8604e75da88400ce1df4b80edc05618cd9db460723ec69504ffdfbfce2eaafb3ba661919ee1f457be29ep_bytes: 558bec51515333c933dbe8bef1ffff84timestamp: 2018-02-27 18:43:29
Version Info:
0: [No Data]

Trojan:Win32/Zbot.GWW!MTB also known as:

Bkav	W32.AIDetect.malware1
Lionic	Trojan.Win32.Generic.4!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Heur.Mint.Dreidel.imX@xqTMcXk
CAT-QuickHeal	Trojan.Necurs.MUE.A3
McAfee	PWS-Zbot!43CA41D09997
Cylance	Unsafe
Zillya	Trojan.Zbot.Win32.206725
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Spyware ( 00009b291 )
Alibaba	TrojanPSW:Win32/GenMalicious.d8112d10
K7GW	Spyware ( 00009b291 )
Cybereason	malicious.099979
Baidu	Win32.Trojan.Zbot.a
VirIT	Trojan.Win32.Panda.T
Cyren	W32/Zbot.BR.gen!Eldorado
Symantec	Trojan.Zbot!gm
ESET-NOD32	a variant of Win32/Spy.Zbot.YW
APEX	Malicious
Avast	Sf:ShellCode-R [Trj]
ClamAV	Win.Spyware.Zbot-1275
Kaspersky	HEUR:Trojan.Win32.Generic
BitDefender	Gen:Heur.Mint.Dreidel.imX@xqTMcXk
NANO-Antivirus	Trojan.Win32.Panda.fespzs
SUPERAntiSpyware	Trojan.Agent/Gen-FakeAlert
Tencent	Malware.Win32.Gencirc.11491330
Ad-Aware	Gen:Heur.Mint.Dreidel.imX@xqTMcXk
Sophos	Mal/Generic-R + Mal/Zbot-HX
Comodo	TrojWare.Win32.Kazy.MKD@4qchol
DrWeb	Trojan.Siggen8.53273
VIPRE	Trojan.Win32.Zbot.n (v)
TrendMicro	Cryp_Xin1
McAfee-GW-Edition	BehavesLike.Win32.Generic.ch
FireEye	Generic.mg.43ca41d099979156
Emsisoft	Gen:Heur.Mint.Dreidel.imX@xqTMcXk (B)
Paloalto	generic.ml
GData	Gen:Heur.Mint.Dreidel.imX@xqTMcXk
Jiangmin	Trojan.Generic.cjrdu
Avira	TR/Spy.Gen
Antiy-AVL	Trojan/Generic.ASMalwS.24B8BCD
Arcabit	Trojan.Mint.Dreidel.E6E39A
Microsoft	Trojan:Win32/Zbot.GWW!MTB
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.FakeAV.C236382
Acronis	suspicious
BitDefenderTheta	Gen:NN.ZexaF.34212.imX@aqTMcXk
ALYac	Gen:Heur.Mint.Dreidel.imX@xqTMcXk
MAX	malware (ai score=100)
VBA32	SScope.Trojan.FakeAV.01110
Malwarebytes	Generic.Malware/Suspicious
TrendMicro-HouseCall	Cryp_Xin1
Rising	Stealer.Zbot!1.648A (CLOUD)
Yandex	Trojan.GenAsa!upgWmf03L4M
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/Zbot.AAN!tr
AVG	Sf:ShellCode-R [Trj]
Panda	Trj/GdSda.A
CrowdStrike	win/malicious_confidence_100% (D)