What is “Win32:Zbot-UQA [Trj]”?

The Win32:Zbot-UQA [Trj] is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Win32:Zbot-UQA [Trj] virus can do?

The binary contains an unknown PE section name indicative of packing
Executable file is packed/obfuscated with MPRESS
Authenticode signature is invalid

How to determine Win32:Zbot-UQA [Trj]?


File Info:
name: ABA96A5DD7CCEBEFD6E1.mlw
path: /opt/CAPEv2/storage/binaries/bb4a3b8ae3b1b2bd6a8defdff8154a8fd8cd38aab126cbc0213fc189dff671d4
crc32: F82248B8
md5: aba96a5dd7ccebefd6e12699cc15a78e
sha1: 8d56ce73f8f69e909bb7d204c61fdde76ccec548
sha256: bb4a3b8ae3b1b2bd6a8defdff8154a8fd8cd38aab126cbc0213fc189dff671d4
sha512: 1e283ce93647c6e3d6db6515bf127723833f0530b8f1b8a9088d2ee76d762c358a5c1a34d3553c497dac5d71e34f8d1b89db39e40a4bf4c0bc248e0a8cc38e1e
ssdeep: 192:0K1K1dXo095xmT0wIEBe39RQjiY39RQji7p1fCaT6YTKwGskFBzxjiQYL6B:IXnBdwIz/0/iaTFNazBiQW6
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T16452F653EF294482D0D32FB9A863E68A4C70B3740AB850B74CD4B54F4DBA9D913AD673
sha3_384: 68ba5e40aa27a8ac786f21e30565b5fa4b69f38705aebaaee177b28cce2380d0927c85d2d924d90fe788ea91cf2e0787
ep_bytes: 674974656d000000476574446c674974
timestamp: 2013-04-02 14:40:54

Version Info:
0: [No Data]

Win32:Zbot-UQA [Trj] also known as:

Bkav	W32.AIDetect.malware1
Cynet	Malicious (score: 100)
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Trojan ( 0052964f1 )
K7GW	Trojan ( 0052964f1 )
CrowdStrike	win/malicious_confidence_100% (D)
Baidu	Win32.Trojan.Agent.eq
Cyren	W32/Damaged_File.E.gen!Eldorado
APEX	Malicious
Avast	Win32:Zbot-UQA [Trj]
Sophos	ML/PE-A
McAfee-GW-Edition	BehavesLike.Win32.Generic.lm
FireEye	Generic.mg.aba96a5dd7ccebef
SentinelOne	Static AI – Malicious PE
AVG	Win32:Zbot-UQA [Trj]
Cybereason	malicious.3f8f69

How to remove Win32:Zbot-UQA [Trj]?

Win32:Zbot-UQA [Trj] removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X