Trojan

Trojan:Win32/Zbot.PVD!MTB information

Malware Removal

The Trojan:Win32/Zbot.PVD!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Trojan:Win32/Zbot.PVD!MTB virus can do?

  • Behavioural detection: Executable code extraction – unpacking
  • SetUnhandledExceptionFilter detected (possible anti-debug)
  • Executed a command line with /C or /R argument to terminate command shell on completion which can be used to hide execution
  • Yara rule detections observed from a process memory dump/dropped files/CAPE
  • Creates RWX memory
  • Dynamic (imported) function loading detected
  • Performs HTTP requests potentially not found in PCAP.
  • Network anomalies occured during the analysis.
  • A process created a hidden window
  • CAPE extracted potentially suspicious content
  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid
  • A ping command was executed with the -n argument possibly to delay analysis
  • Uses Windows utilities for basic functionality
  • Queries information on disks, possibly for anti-virtualization
  • Deletes its original binary from disk
  • Attempts to modify proxy settings
  • Anomalous binary characteristics
  • Uses suspicious command line tools or Windows utilities

How to determine Trojan:Win32/Zbot.PVD!MTB?


File Info:

name: 71CFB9C320E2D0CBB715.mlw
path: /opt/CAPEv2/storage/binaries/0f8167c00ba6e9740c021d4c58f685c866745d2a66be6ca73a4f3b49a1c16c46
crc32: AAC0F4EB
md5: 71cfb9c320e2d0cbb71535f4d49b5ca8
sha1: a15efe56da640a5c91773cdd0ac94d6523765fd6
sha256: 0f8167c00ba6e9740c021d4c58f685c866745d2a66be6ca73a4f3b49a1c16c46
sha512: 2d1224f6dd831224214a80706d00b3722308d14073c15039c0572c0ed0c7276357cbac070e7c8e5e6501a0348cf9131a593baa87c470c589d1ccf5da4c24e6d8
ssdeep: 6144:uYU7CGagzZydyiMJI+/JH1+bFRBuv/rwQ4x5RHr0JpBM4wOhn8PdglG:gPagzMgiAIuJ0bFDyjw2a4wKfA
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1AC94DF92A1BC1B31CC77317B2AD4702A5E6F1FF2A78C141B5BAB1B2489E2B12C55570F
sha3_384: 9677a1b8a005580840a1917708bc6fe507f12eba2d8bd5f3023069bc564d6704b3c4970b9671bcc8de55b3d9072fc7af
ep_bytes: 558bec6aff68f83145006810eb440064
timestamp: 2015-06-03 03:48:13

Version Info:

0: [No Data]

Trojan:Win32/Zbot.PVD!MTB also known as:

BkavW32.AIDetect.malware2
Elasticmalicious (high confidence)
MicroWorld-eScanGen:Variant.Adware.Symmi.51744
FireEyeGeneric.mg.71cfb9c320e2d0cb
CAT-QuickHealTrojan.Bulta.RF6
McAfeePUP-FVM
CylanceUnsafe
Sangfor[ARMADILLO V1.71]
K7AntiVirusTrojan ( 004c6f611 )
K7GWTrojan ( 004c6f611 )
BaiduWin32.Trojan.Kryptik.jv
VirITTrojan.Win32.Crypt_r.AX
CyrenW32/S-d633bdb2!Eldorado
SymantecDownloader
ESET-NOD32a variant of Win32/Kryptik.DKLX
APEXMalicious
ClamAVWin.Adware.Agent-1308946
KasperskyHEUR:Trojan.Win32.Generic
BitDefenderGen:Variant.Adware.Symmi.51744
NANO-AntivirusTrojan.Win32.InstallCube.dsnvey
AvastWin32:Dropper-gen [Drp]
TencentMalware.Win32.Gencirc.10b3d6b9
Ad-AwareGen:Variant.Adware.Symmi.51744
SophosGeneric ML PUA (PUA)
ComodoApplication.Win32.ICLoader.BAQ@5sw92y
DrWebTrojan.InstallCube.262
ZillyaTrojan.Generic.Win32.923536
EmsisoftGen:Variant.Adware.Symmi.51744 (B)
SentinelOneStatic AI – Suspicious PE
GDataGen:Variant.Adware.Symmi.51744
JiangminAdWare.ICLoader.npi
AviraTR/Crypt.ZPACK.Gen
MAXmalware (ai score=67)
MicrosoftTrojan:Win32/Zbot.PVD!MTB
CynetMalicious (score: 100)
AhnLab-V3PUP/Win32.ICLoader.C3534636
Acronissuspicious
BitDefenderThetaAI:Packer.52A652F71E
ALYacGen:Variant.Adware.Symmi.51744
VBA32TScope.Malware-Cryptor.SB
MalwarebytesMalware.AI.743805857
RisingTrojan.Kryptik!8.8 (TFE:dGZlOgWyUs/OoLqFmA)
YandexTrojan.GenAsa!OA8Ce07x5m4
IkarusPUA.ICLoader
MaxSecureTrojan.Malware.300983.susgen
FortinetW32/Generic.AC.12C27C!tr
AVGWin32:Dropper-gen [Drp]
Cybereasonmalicious.320e2d
PandaTrj/Genetic.gen

How to remove Trojan:Win32/Zbot.PVD!MTB?

Trojan:Win32/Zbot.PVD!MTB removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment