home

50d2d7f5761b739f299a968feda56dc2

Blechkörper

FileZilla Project

The file 50d2d7f5761b739f299a968feda56dc2 has been detected as malware by 29 anti-virus scanners. Accoriding to the detections, it is a variant of Zbot (Zeus), a trojan that attempts to steal confidential information (online credentials, and banking details) from a compromised computer and send it to online criminals via a command-and-control server.
Publisher:
FileZilla Project

Product:
Blechkörper

Version:
0.00.0004

MD5:
50d2d7f5761b739f299a968feda56dc2

SHA-1:
946aaac685e75fb1f82773271b42926615836f56

SHA-256:
b5316ec4599d52cbcfa16de48d44e841c96b1e1d8f3dd412db6325b94e5c6adc

Scanner detections:
29 / 68

Status:
Malware

Analysis date:
4/20/2024 1:10:38 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Gen:Variant.Symmi.48111
804

AhnLab V3 Security
Win-Trojan/MDA.140610
2014.11.20

Avira AntiVirus
TR/Dropper.VB.23770
7.11.187.128

avast!
Win32:Zbot-USA [Trj]
2014.9-141123

AVG
Inject2
2015.0.3282

Baidu Antivirus
Trojan.Win32.Zbot
4.0.3.141123

Bitdefender
Gen:Variant.Symmi.48111
1.0.20.1635

Dr.Web
Trojan.PWS.Panda.655
9.0.1.0327

Emsisoft Anti-Malware
Gen:Variant.Symmi.48111
8.14.11.23.09

ESET NOD32
Win32/Injector.BPOR (variant)
8.10750

Fortinet FortiGate
W32/Zbot.UOTS!tr
11/23/2014

F-Secure
Gen:Variant.Symmi.48111
11.2014-23-11_1

G Data
Gen:Variant.Symmi.48111
14.11.24

IKARUS anti.virus
Trojan.Win32.Injector
t3scan.1.8.3.0

K7 AntiVirus
Trojan
13.185.14071

Kaspersky
Trojan-Spy.Win32.Zbot
14.0.0.2903

Malwarebytes
Trojan.Zbot.FKZ
v2014.11.23.09

McAfee
PWSZbot-FAER!50D2D7F5761B
5600.6938

MicroWorld eScan
Gen:Variant.Symmi.48111
15.0.0.981

NANO AntiVirus
Trojan.Win32.Zbot.diycpf
0.28.6.63474

Norman
Suspicious_Gen5.AYZFS
11.20141123

Panda Antivirus
Trj/CI.A
14.11.23.09

Qihoo 360 Security
Win32/Trojan.Dropper.656
1.0.0.1015

Quick Heal
(Suspicious) - DNAScan
11.14.14.00

Rising Antivirus
PE:Malware.XPACK-HIE/Heur!1.9C48
23.00.65.141121

Sophos
Mal/Generic-S
4.98

Trend Micro House Call
TSPY_ZBOT.AAAZAA
7.2.327

Trend Micro
TSPY_ZBOT.AAAZAA
10.465.23

VIPRE Antivirus
Trojan.Win32.Generic
34940

File size:
276 KB (282,624 bytes)

Product version:
0.00.0004

Original file name:
Kernmarktes7.exe

Language:
English (United States)

Common path:
C:\users\{user}\downloads\91\50d2d7f5761b739f299a968feda56dc2

File PE Metadata
Compilation timestamp:
11/16/2014 2:53:53 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
3072:e0hoHG/MfJ+Mc1l2xUmnjzJZO80viPbC90jZdtKNyjBZxx+TIgKjJpNtrRWqjI:VGHGI5xzcvibC90zEyjbxK6Xzl

Entry address:
0x1344

Entry point:
68, 60, 40, 43, 00, E8, EE, FF, FF, FF, 00, 00, 00, 00, 00, 00, 30, 00, 00, 00, 40, 00, 00, 00, 00, 00, 00, 00, 24, E1, 32, E7, 66, 22, E4, 4A, 92, 64, 1A, 3A, 01, 77, DD, 3A, 00, 00, 00, 00, 00, 00, 01, 00, 00, 00, AB, 96, 06, 01, B6, C3, 4E, 61, 67, 65, 6C, 66, 65, 73, 74, 65, 6D, 00, 52, 05, 9A, 1D, 00, 00, 00, 00, FF, CC, 31, 00, 09, 7E, 4E, 52, 93, 20, BB, D5, 41, AC, 07, BD, B4, 95, 08, 2A, EE, F8, DD, 93, 82, 23, 22, 0F, 40, 91, 97, DA, 7D, 4D, 01, F0, 45, 3A, 4F, AD, 33, 99, 66, CF, 11, B7, 0C, 00...
 
[+]

Entropy:
6.7955

Developed / compiled with:
Microsoft Visual Basic v5.0

Code size:
240 KB (245,760 bytes)

Remove 50d2d7f5761b739f299a968feda56dc2 - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.