home

msi19546.exe

The executable msi19546.exe has been detected as malware by 36 anti-virus scanners. Accoriding to the detections, it is a variant of Zbot (Zeus), a trojan that attempts to steal confidential information (online credentials, and banking details) from a compromised computer and send it to online criminals via a command-and-control server.
MD5:
4900d26ef5074467d160a6a92c25ac1f

SHA-1:
f4026a17777f3b688bbed285ba3f5820ec165b4a

SHA-256:
fba7b0823c52fe7f90aac4ff5b29b56da5194c6957949103a4d35523eeb6f371

Scanner detections:
36 / 68

Status:
Malware

Analysis date:
4/23/2024 7:44:09 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Gen:Variant.Kazy.306190
835

Agnitum Outpost
TrojanSpy.Zbot
7.1.1

AhnLab V3 Security
Trojan/Win32.Zbot
2014.08.28

Avira AntiVirus
TR/Spy.ZBot.aauuoa
7.11.169.144

avast!
Win32:Zbot-SDX [Trj]
2014.9-141022

AVG
PSW.Generic12
2015.0.3313

Baidu Antivirus
Trojan.Win32.Zbot
4.0.3.141022

Bitdefender
Gen:Variant.Kazy.306190
1.0.20.1475

Bkav FE
W32.BuefakavLTAAA
1.3.0.4959

Comodo Security
UnclassifiedMalware
19331

Dr.Web
Trojan.PWS.Panda.5182
9.0.1.0295

Emsisoft Anti-Malware
Gen:Variant.Kazy.306190
8.14.10.22.06

ESET NOD32
Win32/Spy.Zbot.AAU
8.10323

Fortinet FortiGate
W32/Zbot.QVDX!tr
10/22/2014

F-Secure
Gen:Variant.Kazy.306190
11.2014-22-10_4

G Data
Gen:Variant.Kazy.306190
14.10.24

IKARUS anti.virus
Trojan-PWS.Win32.Zbot
t3scan.1.7.5.0

K7 AntiVirus
Spyware
13.183.13166

Kaspersky
Trojan-Spy.Win32.Zbot
14.0.0.3061

Malwarebytes
Trojan.Zbot.NR
v2014.10.22.06

McAfee
PWSZbot-FNB!4900D26EF507
5600.6969

Microsoft Security Essentials
PWS:Win32/Zbot
1.10904

MicroWorld eScan
Gen:Variant.Kazy.306190
15.0.0.885

NANO AntiVirus
Trojan.Win32.Zbot.cqqrtu
0.28.2.61861

nProtect
Trojan-Spy/W32.ZBot.312832.AGA
14.08.27.01

Panda Antivirus
Trj/Genetic.gen
14.10.22.06

Qihoo 360 Security
HEUR/Malware.QVM20.Gen
1.0.0.1015

Quick Heal
TrojanPWS.Zbot.AM4
10.14.14.00

Rising Antivirus
PE:Malware.XPACK-HIE/Heur!1.9C48
23.00.65.141020

Sophos
Troj/Agent-AFII
4.98

SUPERAntiSpyware
Trojan.Agent/Gen-Zbot
10283

Trend Micro House Call
TROJ_SPNR.06LD13
7.2.295

Trend Micro
TROJ_SPNR.06LD13
10.465.22

Vba32 AntiVirus
SScope.Malware-Cryptor.Zbot.2613
3.12.26.3

VIPRE Antivirus
Trojan.Win32.Generic!SB.0
32590

Zillya! Antivirus
Trojan.Zbot.Win32.145918
2.0.0.1902

File size:
305.5 KB (312,832 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\appdata\local\temp\msi19546.exe

File PE Metadata
Compilation timestamp:
8/26/2013 12:42:13 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
6144:1c54IPLIVH/mdnB5dzQu+/IKYs8xS7tTTF8ZIGo:+Lqm5BzzfOBoaMZ

Entry address:
0x4932E

Entry point:
55, 8B, EC, 81, EC, B4, 00, 00, 00, 56, 53, 57, FF, 35, 4C, CC, 44, 00, FF, 15, 40, B1, 44, 00, A3, 1C, CB, 44, 00, A1, DC, D0, 44, 00, 3D, 00, 00, 00, 00, 0F, 85, 05, 00, 00, 00, E9, 56, 00, 00, 00, A3, DC, D0, 44, 00, FF, 15, E4, B0, 44, 00, 89, 45, E0, A1, 1C, CB, 44, 00, 89, 45, FC, FF, 15, 68, B0, 44, 00, 89, 45, F8, 8B, 45, FC, A3, 3C, CA, 44, 00, A1, 50, CC, 44, 00, A3, E4, CE, 44, 00, FF, 35, E4, CE, 44, 00, 68, 20, CA, 44, 00, 68, 00, CA, 44, 00, A1, 14, D0, 44, 00, 3D, 00, 00, 00, 00, 0F, 85, 0A...
 
[+]

Entropy:
5.7325

Developed / compiled with:
Microsoft Visual C++

Code size:
294.5 KB (301,568 bytes)

Remove msi19546.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.