home

注册机英文版.exe

The executable 注册机英文版.exe has been detected as malware by 5 anti-virus scanners. Accoriding to the detections, it is a variant of Zbot (Zeus), a trojan that attempts to steal confidential information (online credentials, and banking details) from a compromised computer and send it to online criminals via a command-and-control server. The file has been seen being downloaded from www16.zippyshare.com and multiple other hosts.
MD5:
666d7fdf125c97caa438a8f96feb128e

SHA-1:
a86d08a1fd3074685dce2ba31aab97fa9953bf83

SHA-256:
134345d1d4308e1fd14a21fedcb9a2b0f6c24b7cc8a346293d851f2a02dd6d2d

Scanner detections:
5 / 68

Status:
Malware

Analysis date:
11/16/2024 12:48:48 AM UTC  (today)

Scan engine
Detection
Engine version

Bkav FE
W32.Clod6ac.Trojan
1.3.0.6185

McAfee
Artemis!666D7FDF125C
5600.6941

Norman
ZBot.RDWM
11.20141120

Quick Heal
Win32.PWS.Zbot.4
11.14.14.00

SUPERAntiSpyware
Trojan.Agent/Gen-Zbot
10226

File size:
48.5 KB (49,664 bytes)

File type:
Executable application (Win32 EXE)

File PE Metadata
Compilation timestamp:
11/10/2013 4:34:23 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
5.12

CTPH (ssdeep):
768:mfOZAFYyCxgLa1LknsEjhwAQMYISSMtWnQ7Us7:mmZAFYILatqRmDMOSo7UE

Entry address:
0x21A1

Entry point:
E8, 12, 03, 00, 00, 6A, 00, E8, C9, 02, 00, 00, A3, 10, 63, 40, 00, 68, 48, 50, 40, 00, 6A, 00, 6A, 00, E8, 9E, 02, 00, 00, E8, AB, 02, 00, 00, 3D, B7, 00, 00, 00, 74, 16, 6A, 00, 68, E3, 1F, 40, 00, 6A, 00, 6A, 64, FF, 35, 10, 63, 40, 00, E8, E2, 02, 00, 00, 50, E8, 7C, 02, 00, 00, 55, 8B, EC, 83, C4, F4, 68, 5C, 52, 40, 00, FF, 75, 0C, 6A, 00, E8, 97, 02, 00, 00, 89, 45, FC, 50, 6A, 00, E8, 92, 02, 00, 00, 50, E8, 92, 02, 00, 00, 89, 45, F4, FF, 75, FC, 6A, 00, E8, 91, 02, 00, 00, 89, 45, F8, 83, 7D, F8...
 
[+]

Entropy:
6.4088

Code size:
5.5 KB (5,632 bytes)

The file 注册机英文版.exe has been seen being distributed by the following 50 URLs.

http://www16.zippyshare.com/d/8zdkcFqE/.../keymaker.exe

http://www16.zippyshare.com/d/8zdkcFqE/.../keymaker.exe

http://www16.zippyshare.com/d/8zdkcFqE/.../keymaker.exe

http://www16.zippyshare.com/d/8zdkcFqE/.../keymaker.exe

http://www16.zippyshare.com/d/8zdkcFqE/.../keymaker.exe

http://www16.zippyshare.com/d/8zdkcFqE/.../keymaker.exe

http://www16.zippyshare.com/d/8zdkcFqE/.../keymaker.exe

http://www16.zippyshare.com/d/8zdkcFqE/.../keymaker.exe

http://www16.zippyshare.com/d/8zdkcFqE/.../keymaker.exe

http://www16.zippyshare.com/d/8zdkcFqE/.../keymaker.exe

http://www16.zippyshare.com/d/8zdkcFqE/.../keymaker.exe

https://mega.nz/temporary/.../zhBlAZKB

http://www16.zippyshare.com/d/8zdkcFqE/.../keymaker.exe

http://www15.zippyshare.com/d/NTHjp27U/.../keymaker.exe

http://www15.zippyshare.com/d/NTHjp27U/.../keymaker.exe

http://www16.zippyshare.com/d/8zdkcFqE/.../keymaker.exe

http://www16.zippyshare.com/d/8zdkcFqE/.../keymaker.exe

http://www16.zippyshare.com/d/8zdkcFqE/.../keymaker.exe

http://www16.zippyshare.com/d/8zdkcFqE/.../keymaker.exe

http://www16.zippyshare.com/d/8zdkcFqE/.../keymaker.exe

http://www16.zippyshare.com/d/8zdkcFqE/.../keymaker.exe

http://www16.zippyshare.com/d/8zdkcFqE/.../keymaker.exe

http://www15.zippyshare.com/d/NTHjp27U/.../keymaker.exe

http://www16.zippyshare.com/d/8zdkcFqE/.../keymaker.exe

http://www15.zippyshare.com/d/NTHjp27U/.../keymaker.exe

http://www16.zippyshare.com/d/8zdkcFqE/.../keymaker.exe

http://www16.zippyshare.com/d/8zdkcFqE/.../keymaker.exe

http://www16.zippyshare.com/d/8zdkcFqE/.../keymaker.exe

http://www16.zippyshare.com/d/8zdkcFqE/.../keymaker.exe

http://www16.zippyshare.com/d/8zdkcFqE/.../keymaker.exe

Latest 30 of 94 download URLs

Remove 注册机英文版.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.