Home Malware Programs Trojans Mal/Zbot-EZ

Mal/Zbot-EZ

Posted: January 11, 2012

Threat Metric

Ranking: 931
Threat Level: 2/10
Infected PCs: 98,417
First Seen: January 11, 2012
Last Seen: October 17, 2023
OS(es) Affected: Windows

Mal/Zbot-EZ is a hazardous Trojan and part of the spam emails allegedly coming from the Federal Deposit Insurance Corporation (FDIC). The fake FDIC emails state to carry important information about the recipient's bank. The bogus emails include an infected ZIP file which contains a malicious payload, generated to corrupt Windows PCs. The subject line of the malicious email is 'FDIC: About your business account', followed by a random code number. The attached file name, which contains Mal/Zbot-EZ, is 'FDIC_Information_About-your-business-account-JAN2012-XXXXX.zip', where 'XXXXX' is a random number. If you receive such false FDIC email, do not open and run the attached malicious file to prevent Mal/Zbot-EZ from infecting your computer system.

Aliases

PSW.Generic9.BDFT [AVG]W32/Zbot.EZ [Fortinet]Trojan-Spy.Win32.Zbot [Ikarus]BackDoor.Tdss.7057 [DrWeb]Artemis!6A4624FAA5B7 [McAfee]Bck/Qbot.AO [Panda]W32/Zbot.EZ!tr [Fortinet]Heuristic.BehavesLike.Win32.ModifiedUPX.F [McAfee-GW-Edition]UnclassifiedMalware [Comodo]Generic Downloader.me [McAfee]Win32:MalOb-JE [GData]Trojan.Win32.Menti.lffc [Kaspersky]Win32:MalOb-JE [Cryp] [Avast]a variant of Win32/Kryptik.ZLI [NOD32]Generic.tfr!bf [McAfee]
More aliases (80)

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:



%SystemDrive%\Users\<username>\AppData\Local\Temp:winupd.exe File name: Temp:winupd.exe
Size: 225.79 KB (225792 bytes)
MD5: cb9c5a1af903d39c1e7c9b7613197636
Detection count: 84
File type: Executable File
Mime Type: unknown/exe
Path: %SystemDrive%\Users\<username>\AppData\Local
Group: Malware file
Last Updated: January 28, 2013
%SystemDrive%\process\FC78BA65CC5.exe File name: FC78BA65CC5.exe
Size: 592.89 KB (592896 bytes)
MD5: d40510e40ac66d9899516e0c0c0587a0
Detection count: 61
File type: Executable File
Mime Type: unknown/exe
Path: %SystemDrive%\process
Group: Malware file
Last Updated: April 8, 2013
%SystemDrive%\Romano.Bin\9A0B33B18B1.exe File name: 9A0B33B18B1.exe
Size: 289.79 KB (289792 bytes)
MD5: ee29999784a54829fb1ceb0f411ea504
Detection count: 54
File type: Executable File
Mime Type: unknown/exe
Path: %SystemDrive%\Romano.Bin
Group: Malware file
Last Updated: January 30, 2012
%APPDATA%\Sun\{4E0A7E4D-2058-4115-B4DB-64318D83F088}\Validator.exe File name: Validator.exe
Size: 321.02 KB (321024 bytes)
MD5: 5371dfabb534e53f72d18cddcba4099c
Detection count: 41
File type: Executable File
Mime Type: unknown/exe
Path: %APPDATA%\Sun\{4E0A7E4D-2058-4115-B4DB-64318D83F088}
Group: Malware file
Last Updated: February 1, 2012
%TEMP%\Dropbox.exe File name: Dropbox.exe
Size: 244.73 KB (244736 bytes)
MD5: 6a4624faa5b7ad3f383d55c18a3a168f
Detection count: 11
File type: Executable File
Mime Type: unknown/exe
Path: %TEMP%
Group: Malware file
Last Updated: April 16, 2013
%SystemDrive%\Users\<username>\AppData\Local\Temp:winupd.exe File name: Temp:winupd.exe
Size: 247.29 KB (247296 bytes)
MD5: c41b38e843b797192a0e417f9afff924
Detection count: 5
File type: Executable File
Mime Type: unknown/exe
Path: %SystemDrive%\Users\<username>\AppData\Local
Group: Malware file
Last Updated: January 13, 2012

Additional Information

The following URL's were detected:
gofenews.com
Loading...