Should I remove “Zbot.21 (B)”?

The Zbot.21 (B) is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Zbot.21 (B) virus can do?

The binary contains an unknown PE section name indicative of packing
The executable is compressed using UPX
Authenticode signature is invalid

How to determine Zbot.21 (B)?


File Info:
name: 35E3F05181BC32EC776A.mlw
path: /opt/CAPEv2/storage/binaries/4b83da462093b5ec3477d935887ea9cc2bba35f6cf760969425c9ec1aa4411a5
crc32: DD5E1FC4
md5: 35e3f05181bc32ec776a66c4a32d04ec
sha1: 563cabbcf0d5f1213834a020a38e569df7cb3362
sha256: 4b83da462093b5ec3477d935887ea9cc2bba35f6cf760969425c9ec1aa4411a5
sha512: 2b8752d35df0afa5396d4a7c38bb912d55007d3896356d757532e6aac470bc51cb72a0e0350ed505b8a10299d1e5cd09f6175788355baaed267455b3953460d4
ssdeep: 1536:xOaB3SgfuTfwVi3mD3ACr09OaB3SgfuTfwVito3ACr0:xOaB3S3LEi3mD3t49OaB3S3LEito3t4
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T10094B40E7BD7F3AEEE7BC23E0E495A328AE47557037D8D71C15B6488643B081DE0A256
sha3_384: 57ec710098a48691cf2c3c4498e7e72e7c8cf514054ba825f53d79e9a831edb3f4602a063a56bbbf2d9b6adcb02ba4a1
timestamp: 2001-03-20 06:35:57

Version Info:
0: [No Data]

Zbot.21 (B) also known as:

Bkav	W32.AIDetect.malware1
MicroWorld-eScan	Gen:Variant.Zbot.21
FireEye	Generic.mg.35e3f05181bc32ec
ALYac	Gen:Variant.Zbot.21
Cylance	Unsafe
Sangfor	Suspicious.Win32.Save.a
Cybereason	malicious.181bc3
VirIT	Trojan.Win32.CryptXPACK.CGEE
Elastic	malicious (moderate confidence)
APEX	Malicious
BitDefender	Gen:Variant.Zbot.21
Ad-Aware	Gen:Variant.Zbot.21
Sophos	Generic ML PUA (PUA)
Comodo	Heur.Corrupt.PE@1z141z3
VIPRE	Gen:Variant.Zbot.21
Emsisoft	Gen:Variant.Zbot.21 (B)
SentinelOne	Static AI – Malicious PE
GData	Gen:Variant.Zbot.21
Google	Detected
Microsoft	Program:Win32/Wacapew.C!ml
Cynet	Malicious (score: 100)
MAX	malware (ai score=83)
Malwarebytes	Malware.AI.4108904794
Ikarus	not-a-virus:Porn-Dialer.Win32.Generic
MaxSecure	Trojan.Malware.1528339.susgen
CrowdStrike	win/malicious_confidence_70% (D)

How to remove Zbot.21 (B)?

Zbot.21 (B) removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X