About “Trojan:Win32/Zombie.A” infection

The Trojan:Win32/Zombie.A is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan:Win32/Zombie.A virus can do?

Dynamic (imported) function loading detected
Reads data out of its own binary image
Unconventionial language used in binary resources: Chinese (Simplified)
Authenticode signature is invalid

How to determine Trojan:Win32/Zombie.A?


File Info:
name: 759122730D84F8202DF1.mlw
path: /opt/CAPEv2/storage/binaries/f332f1d2e120ca5deeecc69f396aea55f89761a60e3dd86de1589c6593c3b008
crc32: 1D8BDBF8
md5: 759122730d84f8202df1b4f8d2b4eee5
sha1: 3073b5e6470442efb116c526fe410bffb5d61189
sha256: f332f1d2e120ca5deeecc69f396aea55f89761a60e3dd86de1589c6593c3b008
sha512: 3213ccca7a637d9a9769dbc87f232caee386eba7be3a7e2e5a43d6ba34aa5f02684b9bd57522542924be489a64f647e34f304ec9be4e4fa1fee95f7fc9b4a1d7
ssdeep: 393216:hLlqpN7eqOBgIbai0E8GCM+pvvkCplaZOwH:hxqreaegdp3kCplCOa
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T153D6332D2AB4B518CB871C34C66DBC9EB4C978C0C7EF47A667E877642372163EA41E05
sha3_384: 791a9a694a8bd96aa7a78fe04b73ffcd787c01688eab6a9d0106d9bc65b4c213864b4db35d804b0b326e9261fe0054b9
ep_bytes: 558bec6aff684031400068b022400064
timestamp: 2011-03-15 04:06:07

Version Info:
0: [No Data]

Trojan:Win32/Zombie.A also known as:

MicroWorld-eScan	Trojan.GenericKD.34110279
FireEye	Generic.mg.759122730d84f820
CAT-QuickHeal	W32.Zombie.A4
McAfee	GenericRXNR-SA!759122730D84
Cylance	Unsafe
Zillya	Trojan.Cosmu.Win32.12187
K7AntiVirus	Trojan ( 0055e3dd1 )
BitDefender	Trojan.GenericKD.34110279
K7GW	Trojan ( 0055e3dd1 )
Cyren	W32/Cosmu.H.gen!Eldorado
APEX	Malicious
ClamAV	Win.Trojan.Cosmu-1058
NANO-Antivirus	Trojan.Win32.Cosmu.bgzaxj
Avast	Win32:RansomX-gen [Ransom]
Tencent	Virus.Win32.Cosmu.a
Ad-Aware	Trojan.GenericKD.34110279
Sophos	Mal/Behav-112
Comodo	TrojWare.Win32.Agent.NBJ@4xjtww
DrWeb	Trojan.Encoder.185
VIPRE	Trojan.Win32.Cosmu.bwts (v)
TrendMicro	TROJ_SPNR.15CC13
McAfee-GW-Edition	GenericRXNR-SA!759122730D84
Emsisoft	Trojan.GenericKD.34110279 (B)
Jiangmin	Trojan/Cosmu.ppf
Avira	TR/ATRAPS.Gen
Kingsoft	Heur.SSC.2787082.0010.(kcloud)
Microsoft	Trojan:Win32/Zombie.A
GData	Trojan.GenericKD.34110279
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Cosmu.R51515
BitDefenderTheta	Gen:NN.ZexaF.34160.@tZ@aGBV9uib
VBA32	Trojan.Cosmu
TrendMicro-HouseCall	TROJ_SPNR.15CC13
Rising	Trojan.Zombie!8.2DA5 (RDMK:cmRtazqZA6YRCTDRdADX/kB5jVbL)
Yandex	Trojan.GenAsa!qZCC7vZoV+4
MAX	malware (ai score=89)
Fortinet	W32/Cosmu.BWTS!tr
AVG	Win32:RansomX-gen [Ransom]

How to remove Trojan:Win32/Zombie.A?

Trojan:Win32/Zombie.A removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X