Categories: Malware

What is “Win32:Zbot-RAE [Trj]”?

The Win32:Zbot-RAE [Trj] is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32:Zbot-RAE [Trj] virus can do?

Behavioural detection: Executable code extraction – unpacking
Yara rule detections observed from a process memory dump/dropped files/CAPE
Creates RWX memory
Dynamic (imported) function loading detected
Reads data out of its own binary image
CAPE extracted potentially suspicious content
Authenticode signature is invalid
Uses Windows utilities for basic functionality
Tries to unhook or modify Windows functions monitored by Cuckoo
Collects and encrypts information about the computer likely to send to C2 server
Collects information to fingerprint the system

How to determine Win32:Zbot-RAE [Trj]?


File Info:
name: F355003CCD87C118038D.mlwpath: /opt/CAPEv2/storage/binaries/bbd064307e50e25d5efe38b28df2807bb7bb3dfe3cc614683be7e8f48e3b11eecrc32: 18CCD361md5: f355003ccd87c118038dd6efbe175dd5sha1: a0bbe9c8551f87bea7902150741d1ced64f20c98sha256: bbd064307e50e25d5efe38b28df2807bb7bb3dfe3cc614683be7e8f48e3b11eesha512: c20666c4f06b49e020b533e155d909c2741c7fe39b02ae776cf47b658d05e5f646305d0586a3e9e4827b42a62d9cb81edbc3ad37456c9e5dfb43e78f9b50fdd9ssdeep: 6144:BuTDgotg2p68SjIr+W4eJ0hMyrT1XQJOhihiJSlnevzY3OL:BX8SsH4eJ0my+JGihiKnevzXLtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T15B64BF16A17723A0EEC0ED3474B59250DF7A6E78E3CDC7EB5608317316B00A2A7AD271sha3_384: 1977a448c35beae805bddb059b57187a9656fba4e9554d58e053d85af8657a7241502235b875a61cd9492bbba07e9d35ep_bytes: 558bec6aff6828c944006818d1410064timestamp: 2013-04-30 15:27:18
Version Info:
0: [No Data]

Win32:Zbot-RAE [Trj] also known as:

Lionic	Trojan.Win32.Zbot.l!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Heur.JBot.1
FireEye	Generic.mg.f355003ccd87c118
McAfee	PWS-Zbot-FAYH!F355003CCD87
Cylance	Unsafe
VIPRE	Trojan.Win32.Zbot.ma!ag (v)
Sangfor	Trojan.Win32.Zbot.atRAJ
K7AntiVirus	Spyware ( 0029a43a1 )
Alibaba	TrojanSpy:Win32/TScope.1455f3b8
K7GW	Spyware ( 0029a43a1 )
CrowdStrike	win/malicious_confidence_100% (W)
BitDefenderTheta	Gen:NN.ZexaF.34232.tqW@aeeZefji
VirIT	Trojan.Win32.Generic.BES
Cyren	W32/A-7e4c5d50!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	Win32/Spy.Zbot.AAO
APEX	Malicious
Paloalto	generic.ml
Kaspersky	HEUR:Trojan.Win32.Generic
BitDefender	Gen:Heur.JBot.1
NANO-Antivirus	Trojan.Win32.Panda.cqpgdd
SUPERAntiSpyware	Trojan.Agent/Gen-Festo
Avast	Win32:Zbot-RAE [Trj]
Tencent	Malware.Win32.Gencirc.10c87710
Ad-Aware	Gen:Heur.JBot.1
TACHYON	Trojan-Spy/W32.ZBot.318976.AX
Sophos	Mal/Generic-S
Comodo	Malware@#wrtdcs86jliv
F-Secure	Trojan.TR/Spy.Zbot.318975
DrWeb	Trojan.PWS.Panda.2401
Zillya	Trojan.Zbot.Win32.117405
TrendMicro	TSPY_ZBOT.MEO
McAfee-GW-Edition	PWS-Zbot-FAYH!F355003CCD87
Emsisoft	Gen:Heur.JBot.1 (B)
Ikarus	Trojan-Spy.Win32.Zbot
GData	Gen:Heur.JBot.1
Jiangmin	TrojanSpy.Zbot.dbpq
Avira	TR/Spy.Zbot.318975
Antiy-AVL	Trojan[Spy]/Win32.Zbot
Kingsoft	Win32.Troj.Zbot.kz.(kcloud)
Gridinsoft	Ransom.Win32.Zbot.sa
Arcabit	Trojan.JBot.1
ViRobot	Trojan.Win32.Z.Zbot.318976.U
ZoneAlarm	HEUR:Trojan.Win32.Generic
Microsoft	PWS:Win32/Zbot
Cynet	Malicious (score: 100)
AhnLab-V3	Spyware/Win32.Zbot.R64614
VBA32	TScope.Malware-Cryptor.SB
ALYac	Gen:Heur.JBot.1
MAX	malware (ai score=99)
Malwarebytes	Virus.Expiro
TrendMicro-HouseCall	TSPY_ZBOT.MEO
Rising	Spyware.Zbot!8.16B (CLOUD)
Yandex	Trojan.GenAsa!coSpYd1rq4I
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/ZAccess.Y!tr
Webroot	W32.Infostealer.Zeus
AVG	Win32:Zbot-RAE [Trj]
Cybereason	malicious.ccd87c
Panda	Trj/Dtcontx.D