home

f3oo9.exe

Direktumkehrverfahrens

Sophos Plc

The executable f3oo9.exe has been detected as malware by 27 anti-virus scanners. It is set to automatically start when a user logs into Windows via the current user run registry key under the display name ‘Ubhnmedia’. Accoriding to the detections, it is a variant of Zbot (Zeus), a trojan that attempts to steal confidential information (online credentials, and banking details) from a compromised computer and send it to online criminals via a command-and-control server.
Publisher:
Sophos Plc  (signed and verified)

Product:
Direktumkehrverfahrens

Description:
Laufmaschenfeste

Version:
0.03.0006

MD5:
36073a3369cbb695c803b69e6021dd74

SHA-1:
bef6874494ba0b312f57f308f9ebe62a9372c904

SHA-256:
5f2c579b2c6d2d37074d6cfa186b8134425b59fa621cdb778d179c57e62b6561

Scanner detections:
27 / 68

Status:
Malware

Analysis date:
11/15/2024 3:28:17 PM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Gen:Variant.Symmi.48283
-33

Agnitum Outpost
Trojan.Injector
7.1.1

AhnLab V3 Security
Trojan/Win32.MDA
2015.05.14

Avira AntiVirus
TR/Dropper.VB.23178
8.3.1.6

avast!
Win32:Dropper-gen [Drp]
2014.9-170309

AVG
Inject2
2018.0.2445

Bitdefender
Gen:Variant.Symmi.48283
1.0.20.340

Dr.Web
Trojan.Siggen6.23087
9.0.1.068

Emsisoft Anti-Malware
Gen:Variant.Symmi.48283
8.17.03.09.03

ESET NOD32
Win32/Injector.BOVR (variant)
11.11625

Fortinet FortiGate
W32/Injector.BPDI!tr
3/9/2017

F-Secure
Gen:Variant.Symmi.48283
11.2017-09-03_5

G Data
Gen:Variant.Symmi.48283
17.3.25

K7 AntiVirus
Trojan
13.203.15907

Kaspersky
Trojan.Win32.VBKryjetor
14.0.0.-1281

Malwarebytes
Spyware.Zbot.ED
v2017.03.09.03

McAfee
GenericATG-FAWE!36073A3369CB
5600.6101

Microsoft Security Essentials
Trojan:Win32/Miuref.F
1.1.11602.0

MicroWorld eScan
Gen:Variant.Symmi.48283
18.0.0.204

Quick Heal
VirTool.VBInject.LE3
3.17.14.00

Sophos
Mal/Generic-S
4.98

Total Defense
Win32/Tnega.TaLeBN
37.1.62.1

Trend Micro House Call
TROJ_GEN.R0C1C0DL414
7.2.68

Trend Micro
TROJ_GEN.R0C1C0DL414
10.465.09

Vba32 AntiVirus
Trojan.VBKryjetor
3.12.26.4

VIPRE Antivirus
Trojan.Win32.Generic
40220

Zillya! Antivirus
Trojan.VBKryjetor.Win32.365
2.0.0.2176

File size:
135.1 KB (138,296 bytes)

Product version:
0.03.0006

Copyright:
Papierkonzern

Trademarks:
Partnermagazins

Original file name:
Potz.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\appdata\local\ubhnmedia\f3oo9.exe

Digital Signature
Signed by:
Sophos Plc

Authority:
VeriSign, Inc.

Valid from:
3/24/2006 6:00:00 PM

Valid to:
3/31/2009 5:59:59 PM

Subject:
CN=Sophos Plc, OU=Q4, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=Sophos Plc, L=Abingdon, S=Oxfordshire, C=GB

Issuer:
CN=VeriSign Class 3 Code Signing 2004 CA, OU=Terms of use at https://www.verisign.com/rpa (c)04, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
6F20F96294006E1A8322B8D299D7D964

File PE Metadata
Compilation timestamp:
11/30/2014 6:46:00 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

Entry address:
0x129C

Entry point:
68, 10, 89, 41, 00, E8, EE, FF, FF, FF, 00, 00, 00, 00, 00, 00, 30, 00, 00, 00, 40, 00, 00, 00, 00, 00, 00, 00, 38, DA, 30, 9B, 6F, 06, FA, 44, B1, 07, 63, EE, 49, 9B, E7, 92, 00, 00, 00, 00, 00, 00, 01, 00, 00, 00, 73, 74, 0D, 0A, 43, 61, 4C, 61, 6E, 67, 77, 65, 69, 6C, 74, 65, 35, 00, 20, 20, 20, 20, 00, 00, 00, 00, FF, CC, 31, 00, 07, B2, EC, 41, 55, D1, 1C, 80, 4D, 89, 34, 0E, 52, 31, E4, AA, 04, 28, 45, FD, 03, 25, FA, 8D, 44, 83, 2D, 26, EC, 99, CB, 5B, 12, 3A, 4F, AD, 33, 99, 66, CF, 11, B7, 0C, 00...
 
[+]

Entropy:
5.6213

Developed / compiled with:
Microsoft Visual Basic v5.0

Code size:
120 KB (122,880 bytes)

Startup File (User Run)
Registry location:
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
Ubhnmedia

Command:
C:\users\{user}\appdata\local\ubhnmedia\f3oo9.exe


Remove f3oo9.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.