Categories: Trojan

Should I remove “Trojan:Win32/Zbot.RPG!MTB”?

The Trojan:Win32/Zbot.RPG!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan:Win32/Zbot.RPG!MTB virus can do?

Behavioural detection: Executable code extraction – unpacking
Sample contains Overlay data
Reads data out of its own binary image
CAPE extracted potentially suspicious content
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid
Collects information to fingerprint the system

How to determine Trojan:Win32/Zbot.RPG!MTB?


File Info:
name: 6A1E28142B3C565A57DA.mlwpath: /opt/CAPEv2/storage/binaries/49c353dfba821edfdd84ebec7903e52b9ef52f5c1f82b6e2f57f3031e7be8a12crc32: BB1B3496md5: 6a1e28142b3c565a57da7141f9760fafsha1: 4b07932f39ff86f3bbe866e521534c8175a33dd0sha256: 49c353dfba821edfdd84ebec7903e52b9ef52f5c1f82b6e2f57f3031e7be8a12sha512: aca6b43b0bb0c68a77efce2bef8b95b60edae5e6e1a1cdaa7be05b34fccf81ed19b53867b225b1ddf35731c15d7c24fd077a4b005a002456bf61e5a35bc1ee59ssdeep: 3072:L9s4j1DcPQLFtr/SzSdQJSz3pRM5warpRap:Hj1oIn/SzSbzU5warpWtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T19B849CCE7E908C43E811793FA857CFF80A71BC398965425332F5EA5FECB2250D92A611sha3_384: 4fe55800b2a1d0bd53a522830f89a975e488961d6f2f857edb8d81d80dd28a0544be7e954bb6316b34e5af99c9fbd056ep_bytes: 535152c8800000c7458001000000eb23timestamp: 2010-10-18 02:47:44
Version Info:
0: [No Data]

Trojan:Win32/Zbot.RPG!MTB also known as:

Bkav	W32.AIDetect.malware1
Lionic	Trojan.Win32.Generic.lUUy
MicroWorld-eScan	Trojan.GenericKD.62402152
ClamAV	Win.Trojan.Agent-1311818
FireEye	Generic.mg.6a1e28142b3c565a
McAfee	Dropper-FGD!6A1E28142B3C
Cylance	Unsafe
VIPRE	Trojan.GenericKD.62402152
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 0040f4c81 )
Alibaba	Trojan:Win32/Kryptik.b7e387c0
K7GW	Trojan ( 0040f4c81 )
Cybereason	malicious.42b3c5
VirIT	Trojan.Win32.Generic.AVHZ
Cyren	W32/GenTroj.BW.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/Kryptik.BDIA
APEX	Malicious
Paloalto	generic.ml
Cynet	Malicious (score: 100)
Kaspersky	HEUR:Trojan.Win32.Generic
BitDefender	Trojan.GenericKD.62402152
NANO-Antivirus	Virus.Win32.Virut-Gen.bwpxnc
Avast	Win32:Kryptik-MBL [Trj]
Tencent	Win32.Trojan.Generic.Dnhl
Ad-Aware	Trojan.GenericKD.62402152
Emsisoft	Trojan.GenericKD.62402152 (B)
Comodo	TrojWare.Win32.ShipUp.CJB@4yle00
DrWeb	Trojan.Mods.1
Zillya	Trojan.Kryptik.Win32.3919456
TrendMicro	PAK_Xed-21
McAfee-GW-Edition	BehavesLike.Win32.PinkSbot.fz
Trapmine	malicious.high.ml.score
Sophos	ML/PE-A + Troj/Gepys-A
SentinelOne	Static AI – Malicious PE
GData	Win32.Trojan.PSE.E9CWI8
Jiangmin	Trojan/ShipUp.qq
Avira	TR/Crypt.ZPACK.Gen2
MAX	malware (ai score=80)
Antiy-AVL	Trojan/Generic.ASMalwS.50E8
Microsoft	Trojan:Win32/Zbot.RPG!MTB
Google	Detected
AhnLab-V3	Win-Trojan/Dofoil.Gen
BitDefenderTheta	Gen:NN.ZexaF.34698.yuX@aCbUpZl
ALYac	Trojan.GenericKD.62402152
VBA32	BScope.Trojan.Mods
Malwarebytes	Malware.AI.332859870
TrendMicro-HouseCall	PAK_Xed-21
Rising	Dropper.Gepys!8.15D (TFE:5:TkUUJAYEv2G)
Yandex	Trojan.Agent!nKZwcinwxz0
Ikarus	Trojan-Downloader.Win32.Dofoil
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/Kryptik.BCX!tr
AVG	Win32:Kryptik-MBL [Trj]
Panda	Trj/Genetic.gen
CrowdStrike	win/malicious_confidence_100% (W)