Categories: Malware

Zbot.122 (B) removal

The Zbot.122 (B) is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Zbot.122 (B) virus can do?

SetUnhandledExceptionFilter detected (possible anti-debug)
Yara rule detections observed from a process memory dump/dropped files/CAPE
Presents an Authenticode digital signature
Creates RWX memory
Dynamic (imported) function loading detected
Unconventionial binary language: Chinese (Simplified)
Unconventionial language used in binary resources: Chinese (Simplified)
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
Queries information on disks, possibly for anti-virtualization
Attempted to write directly to a physical drive
Attempts to modify proxy settings

How to determine Zbot.122 (B)?


File Info:
name: CE8869A7D918008ADCB2.mlwpath: /opt/CAPEv2/storage/binaries/18c0e7e4db51275ab39052e9120017ff6629cc6bf75be051f74e4df7adb1142acrc32: 6A8FF2DAmd5: ce8869a7d918008adcb26cfca9f47fd7sha1: b5667ad0fd67f8ff36bcc25cdf62068494a2b36csha256: 18c0e7e4db51275ab39052e9120017ff6629cc6bf75be051f74e4df7adb1142asha512: e3de03111878043c08ee8e5608aa7375892ced83bb9e9c55655aedd21b59631ca326c8f4c6a4ae71a9425a894530bc4af2588eb24027910ddb32d4305b72b4f8ssdeep: 196608:PSFs4UdVEy9qMBNLtR2Gk2MXxMID2IbseunP3QxZ8zti5UOSnb0/:H4UdVEy9qMBNLtYSMK+On4X8I5UOSnbYtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T106B612127AC1C072E6961176557DABBF893EAE341734C9C793E02E784D301C2AE3A75Esha3_384: 1780f4ec6a9ae009e88df714ac1bee3c7a42dbe19ce927af9d693c9e173525b0738c9cdfd0a7b623f379f6901f743c32ep_bytes: e8720d0000e925feffffcccccccccc53timestamp: 2022-06-10 09:01:03
Version Info:
CompanyName: 上海奇鲁网络科技有限公司FileDescription: TabX Explorer安装程序FileVersion: 1.2322.1000.613InternalName: install.exeLegalCopyright: Copyright (C) 2022OriginalFilename: install.exeProductName: TabX ExplorerProductVersion: 1.2322.1000.613Translation: 0x0804 0x04b0

Zbot.122 (B) also known as:

MicroWorld-eScan	Gen:Variant.Zbot.122
K7AntiVirus	Adware ( 00589e9a1 )
BitDefender	Gen:Variant.Zbot.122
K7GW	Adware ( 00589e9a1 )
Arcabit	Trojan.Zbot.122
Elastic	malicious (moderate confidence)
ESET-NOD32	a variant of Win32/Qihoo360.O potentially unwanted
Avast	Win32:MiscX-gen [PUP]
Kaspersky	VHO:Exploit.Win32.UAC.gen
Emsisoft	Gen:Variant.Zbot.122 (B)
Microsoft	PUA:Win32/Pearfoos.B!ml
GData	Win32.Application.Agent.PX46Y9
Cynet	Malicious (score: 100)
MAX	malware (ai score=85)
VBA32	Adware.Presenoker
Malwarebytes	PUP.Optional.ChinAd
Rising	Trojan.Generic@AI.76 (RDMK:cmRtazpEgREjLkjrdZ+/8ek/om8u)
Ikarus	PUA.Qihoo360
Fortinet	Riskware/Qihoo360
AVG	Win32:MiscX-gen [PUP]
Cybereason	malicious.7d9180