Trojan:Win32/Zbot!pz (file analysis)

The Trojan:Win32/Zbot!pz is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan:Win32/Zbot!pz virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Sample contains Overlay data
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Unconventionial binary language: Russian
• Unconventionial language used in binary resources: Russian
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Collects information to fingerprint the system
• Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Trojan:Win32/Zbot!pz?

File Info:
name: E5F24BED94972FC82F8F.mlw
path: /opt/CAPEv2/storage/binaries/b22fb843a3e706c028a1e1aa161542cea9fc10f07545547ee65a24df65d73005
crc32: 83AC9290
md5: e5f24bed94972fc82f8f4b40592bc88d
sha1: 282c2ee1709355515b99500058923dcfb362ed94
sha256: b22fb843a3e706c028a1e1aa161542cea9fc10f07545547ee65a24df65d73005
sha512: 9fadd089bc42dfa35919fd8874a569925bb73bd4d2b19d624561a63e083c3f10f5e5e40a758566a5af255b7b073c921f7d2a4baaf21bc24618b1fd20714d9bc7
ssdeep: 49152:uPdBxfwAGzX5flJ4z2sH4hbYj/6Wrbg+9J50:wdBxfKflJ4CsH4eps
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1CB752373F189EDF1C09D98B651C512AF145082B294DF0323E08A2226FDEBF9A79D654F
sha3_384: f8e3050296247284e9ff696a8f28f30b6239fce2d8aa6069f225d95e651532df7c2fb3d311d2cd3f11e6e885ed3590b5
ep_bytes: 558bec81ec180200008b4d08890de47a
timestamp: 2013-08-30 13:55:52

Version Info:
CompanyName: Корпорация  М айкрософт
FileDescription: Диспетчер синхронизации
FileVersion: 5.1.2600.5512 (xpsp.080413-2108)
Translation: 0x0419 0x04b0

Trojan:Win32/Zbot!pz also known as:

How to remove Trojan:Win32/Zbot!pz?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.