Zbot.19 (B) (file analysis)

The Zbot.19 (B) is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Zbot.19 (B) virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Behavioural detection: Executable code extraction – unpacking
• At least one process apparently crashed during execution
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Dynamic (imported) function loading detected
• Unconventionial language used in binary resources: Russian
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• The executable is compressed using UPX
• Authenticode signature is invalid

How to determine Zbot.19 (B)?

File Info:
name: A13DC6777D6F9310B2BB.mlw
path: /opt/CAPEv2/storage/binaries/d044c6e886b3c62799c153dfc141311b2cf275af15a6360120488e80bf620ed1
crc32: 59B99B88
md5: a13dc6777d6f9310b2bbd3b8350d1029
sha1: dffab2b19917699b0166745b029fb6b7594dff64
sha256: d044c6e886b3c62799c153dfc141311b2cf275af15a6360120488e80bf620ed1
sha512: dec40e4d7e5d36df6d180a452458a6b93cbb1433dd970dc3f8810dde69b0ea2a85da8b9f9ac4b61b9afc58121d45b368c3c3697c93663e48571cad185af40f53
ssdeep: 3072:aS1cU4Aq9yWWCzmgYCquRErAeEIoqzmM/b2x4hOtjZH9f7swAtm:aMc7Aq9aCz43G2gqDI4g5R7gg
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1C2D3122AA77141CBD4B34B7A8C40D72207372CF2CD6BB61E41ECA6442967379FCA8567
sha3_384: 3b0d440b2a26a65003e7881e2330e7ce495cc9c6938f10db7b5898d76708a5ea788b71219b6c577da7f5ced253b0d0cf
ep_bytes: 60be154044008dbeebcffbff57eb0b90
timestamp: 2005-04-21 21:43:05

Version Info:
CompanyName: SOFTWIN S.R.L.
FileDescription: BitDefender Management Console
FileVersion: 10, 2, 0, 15
InternalName: Management Console
LegalCopyright: © 2006 SOFTWIN S.R.L.
OriginalFilename: bdmcon.exe
ProductName: BitDefender 10
ProductVersion: 10, 2, 0, 15
Translation: 0x0409 0x04b0

Zbot.19 (B) also known as:

How to remove Zbot.19 (B)?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.