About “Trojan:Win32/Zbot.SIBV!MTB” infection

The Trojan:Win32/Zbot.SIBV!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan:Win32/Zbot.SIBV!MTB virus can do?

Reads data out of its own binary image
Authenticode signature is invalid
Anomalous binary characteristics

How to determine Trojan:Win32/Zbot.SIBV!MTB?


File Info:
name: 182527D4CB70327A9A4A.mlw
path: /opt/CAPEv2/storage/binaries/ef72c0f79952f815e4f390d65471a5a99bbc94117ec65ef2df4697dd82cc7aa7
crc32: C96584EF
md5: 182527d4cb70327a9a4a0309eb127aba
sha1: 51f283e5b1e45929b45687749f775f6ffbde2c02
sha256: ef72c0f79952f815e4f390d65471a5a99bbc94117ec65ef2df4697dd82cc7aa7
sha512: 27c727516dd18ed0998346d7226bae654634c6c8b4748f8100de76ec783f62d83ca5967ecf4a7df0a6b7a88d3ca86e805b7a50f23b0167e5063ce670eee0f703
ssdeep: 3072:WxcWrLfFqZ0ZY+lzGG4+Me/IO0RMIY2q/g3:wvfFqZ0ZlzGKFwO0M2l
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T11DF38D3A3681C0B3C55710349AF4C7B69EBEB8725B6074CB6BD5277E0F252D19A3831A
sha3_384: 9d8ed8d299a0b20e8325f2d07ff93d5f1e3dc1097af7f2b1b60fa3cb377b2736921e680db38af34a959889c6f2860204
ep_bytes: e84f660000e995feffff3b0d10584200
timestamp: 2013-05-25 01:00:05

Version Info:
0: [No Data]

Trojan:Win32/Zbot.SIBV!MTB also known as:

Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Fugrafa.1402
ClamAV	Win.Dropper.Zeus-9808470-0
FireEye	Generic.mg.182527d4cb70327a
CAT-QuickHeal	TrojanPWS.Zbot.Gen
McAfee	PWS-Zbot-FASF!182527D4CB70
Cylance	unsafe
VIPRE	Gen:Variant.Fugrafa.1402
K7AntiVirus	Riskware ( 0040eff71 )
K7GW	Riskware ( 0040eff71 )
Baidu	Win32.Trojan.Delf.in
VirIT	Trojan.Win32.Generic.ANCQ
tehtris	Generic.Malware
ESET-NOD32	a variant of Win32/Injector.AHFH
APEX	Malicious
Cynet	Malicious (score: 99)
Kaspersky	VHO:Trojan-Spy.Win32.Zbot.gen
BitDefender	Gen:Variant.Fugrafa.1402
NANO-Antivirus	Trojan.Win32.Ruskill.cqjdcy
Avast	Win32:Spyeye-AHX [Trj]
Tencent	Malware.Win32.Gencirc.115dd183
Sophos	Troj/Agent-ACBE
DrWeb	Trojan.MulDrop4.48600
Zillya	Trojan.Zbot.Win32.119079
McAfee-GW-Edition	PWS-Zbot-FASF!182527D4CB70
Trapmine	malicious.moderate.ml.score
Emsisoft	Gen:Variant.Fugrafa.1402 (B)
Ikarus	Trojan-PWS.Win32.Zbot
GData	Gen:Variant.Fugrafa.1402
Avira	TR/Spy.Zbot.aeg
Antiy-AVL	Trojan/Win32.Unknown
Xcitium	TrojWare.Win32.Injector.AHIB@4ydd35
Arcabit	Trojan.Fugrafa.D57A
Microsoft	Trojan:Win32/Zbot.SIBV!MTB
Google	Detected
AhnLab-V3	Trojan/Win32.Zbot.R67906
BitDefenderTheta	Gen:NN.ZexaF.36308.kuW@aOnxDndi
ALYac	Gen:Variant.Fugrafa.1402
MAX	malware (ai score=87)
VBA32	BScope.Trojan.MulDrop
Malwarebytes	Malware.AI.2415010932
Rising	Malware.Undefined!8.C (TFE:5:fbfKfPrmKP)
Yandex	Trojan.GenAsa!QBGwtxXWMNE
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/Injector.AJAR!tr
AVG	Win32:Spyeye-AHX [Trj]

How to remove Trojan:Win32/Zbot.SIBV!MTB?

Trojan:Win32/Zbot.SIBV!MTB removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X