Uztub.14 (file analysis)

The Uztub.14 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Uztub.14 virus can do?

Executable code extraction
Injection (inter-process)
Injection (Process Hollowing)
Presents an Authenticode digital signature
Creates RWX memory
Repeatedly searches for a not-found process, may want to run with startbrowser=1 option
A process created a hidden window
The binary likely contains encrypted or compressed data.
Executed a process and injected code into it, probably while unpacking
Network activity detected but not expressed in API logs
Anomalous binary characteristics
Unusual version info supplied for binary

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine Uztub.14?


File Info:
crc32: EB9D846C
md5: 7c22e57914fdb9b77221dc06bc1bece2
name: upload_file
sha1: c2f460cc8ba826320746cbf2a59022cb9c3ccd0f
sha256: 782f821689d70d89096d4cb5da89ce0ceb35393da77896610d5c2d4edd7414a5
sha512: b36027df3d57d0afb8fa10fe8e2067799964f1143cd080fde88fc9f4ba9351737a21d0ce4332f5261a062400eaf49343acf139d4abb0af8b2dae430ef35bfec0
ssdeep: 6144:Eekl0028qrQQFPX0ZbGx+xrbAK+4IR8fbdB:E88X76UVbAF18fbdB
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: (c) 2020 Skype and/or Microsoft
InternalName: Skype.exe
FileVersion: 8.60.0.76
CompanyName: Skype Technologies S.A.
SquirrelAwareVersion: 1
ProductName: Skype
ProductVersion: 8.60
FileDescription: Skype
OriginalFilename: Skype.exe
Translation: 0x0409 0x04b0

Uztub.14 also known as:

MicroWorld-eScan	Gen:Variant.Uztub.14
FireEye	Generic.mg.7c22e57914fdb9b7
CAT-QuickHeal	Trojan.Zenpak
McAfee	Artemis!7C22E57914FD
Cylance	Unsafe
K7AntiVirus	Trojan ( 0055fed21 )
Alibaba	Backdoor:Win32/KZip.da02b622
K7GW	Trojan ( 0055fed21 )
Cybereason	malicious.914fdb
Arcabit	Trojan.Uztub.14
Invincea	heuristic
Symantec	Trojan.Gen.MBT
TrendMicro-HouseCall	TROJ_GEN.R002C0GFS20
Avast	Win32:Trojan-gen
GData	Gen:Variant.Uztub.14
Kaspersky	Trojan.Win32.Zenpak.aihq
BitDefender	Gen:Variant.Uztub.14
AegisLab	Trojan.Win32.Zenpak.4!c
Tencent	Win32.Trojan.Zenpak.Ahyg
Ad-Aware	Gen:Variant.Uztub.14
Emsisoft	MalCert-S.BS (A)
F-Secure	Trojan.TR/Dropper.Gen
DrWeb	Trojan.Trick.46455
VIPRE	Worm.Win32.Phorpiex.ba (v)
TrendMicro	TROJ_GEN.R002C0GFS20
Sophos	Mal/Generic-S
APEX	Malicious
Jiangmin	Trojan.Zenpak.cis
Webroot	W32.Trojan.Gen
Avira	TR/Dropper.Gen
Antiy-AVL	Trojan/Win32.Zenpak
Microsoft	Trojan:Win32/Occamy.C78
Endgame	malicious (high confidence)
ViRobot	Trojan.Win32.Z.Uztub.233984
ZoneAlarm	Trojan.Win32.Zenpak.aihq
Cynet	Malicious (score: 100)
VBA32	TScope.Trojan.VB
ALYac	Trojan.Banker.TinyNuke
MAX	malware (ai score=82)
Malwarebytes	Trojan.MalPack.VB
ESET-NOD32	Win32/Tinukebot.AO
Rising	Dropper.Generic!8.35E (CLOUD)
Ikarus	Trojan-Spy.Win32.Zbot
AVG	Win32:Trojan-gen
Panda	Trj/CI.A
CrowdStrike	win/malicious_confidence_60% (W)
Qihoo-360	Win32/Trojan.874

How to remove Uztub.14?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.