home

updateflashplayer_4e78b51a.exe

The executable updateflashplayer_4e78b51a.exe has been detected as malware by 35 anti-virus scanners. Accoriding to the detections, it is a variant of Zbot (Zeus), a trojan that attempts to steal confidential information (online credentials, and banking details) from a compromised computer and send it to online criminals via a command-and-control server.
MD5:
8c06c1cb09bfd9607528ad9ff4b241f2

SHA-1:
ff72bf92fd038ff307d916e21a677d33f3217573

SHA-256:
3e98ec64620fd0f4f6a76146498b2a9dc233d63634c150513d4a1756cc9d0f83

Scanner detections:
35 / 68

Status:
Malware

Analysis date:
5/2/2024 4:20:24 PM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Gen:Variant.Zbot.125
-40

Agnitum Outpost
TrojanSpy.Zbot
7.1.1

AhnLab V3 Security
Trojan/Win32.Stealer
2015.03.07

Avira AntiVirus
TR/Spy.ZBot.riti
7.11.214.140

avast!
Win32:Zbot-SOT [Trj]
2014.9-170315

AVG
PSW.Generic12
2018.0.2438

Baidu Antivirus
Trojan.Win32.Injector
4.0.3.17315

Bitdefender
Gen:Variant.Zbot.125
1.0.20.370

Bkav FE
W32.GenericSlenfbotL.Trojan
1.3.0.6379

Comodo Security
UnclassifiedMalware
21319

Dr.Web
Trojan.PWS.Panda.547
9.0.1.074

Emsisoft Anti-Malware
Gen:Variant.Zbot.125
8.17.03.15.04

ESET NOD32
Win32/Injector.AWIC (variant)
11.11282

Fortinet FortiGate
W32/Ransom.CE!tr
3/15/2017

F-Secure
Gen:Variant.Zbot.125
11.2017-15-03_4

G Data
Gen:Variant.Zbot.125
17.3.25

IKARUS anti.virus
Trojan-Downloader.Win32.Upatre
t3scan.1.8.6.0

K7 AntiVirus
Trojan
13.200.15187

Kaspersky
HEUR:Trojan.Win32.Generic
14.0.0.-1313

Malwarebytes
Trojan.Agent.ED
v2017.03.15.04

McAfee
Dowloader-FEX
5600.6094

Microsoft Security Essentials
VirTool:Win32/CeeInject.gen!KK
1.1.11400.0

MicroWorld eScan
Gen:Variant.Zbot.125
18.0.0.222

NANO AntiVirus
Trojan.Win32.Panda.ctaegu
0.30.0.296

Norman
Injector.GIOY
11.20170315

Panda Antivirus
Trj/CI.A
17.03.15.04

Qihoo 360 Security
Win32/Trojan.e6d
1.0.0.1015

Quick Heal
TrojanPWS.Zbot.Gen
3.17.14.00

Sophos
Troj/HkMain-BT
4.98

Total Defense
Win32/CInject.aKfWbVB
37.0.11481

Trend Micro House Call
TROJ_SPNR.0BB814
7.2.74

Trend Micro
TROJ_SPNR.0BB814
10.465.15

Vba32 AntiVirus
TrojanPSW.Tepfer
3.12.26.3

VIPRE Antivirus
Trojan.Win32.Generic
38188

Zillya! Antivirus
Trojan.Zbot.Win32.146811
2.0.0.2090

File size:
154.8 KB (158,521 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\appdata\local\temp\updateflashplayer_4e78b51a.exe

File PE Metadata
Compilation timestamp:
1/15/2014 12:23:55 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

Entry address:
0x3F8C

Entry point:
55, 8B, EC, 6A, FF, 68, 90, 58, 40, 90, 68, 8E, 41, 40, 00, 64, A1, 00, 00, 00, 00, 90, 64, 89, 25, 00, 00, 00, 00, 83, EC, 68, 53, 56, 57, 89, 65, E8, 33, DB, 89, 5D, FC, 6A, 02, 5F, 57, FF, 15, 00, 52, 40, 00, 59, 83, 0D, CC, 7A, 40, 00, FF, 83, 0D, D0, 7A, 40, 00, FF, FF, 15, 04, 52, 40, 00, 8B, 0D, C0, 7A, 40, 00, 89, 08, FF, 15, 08, 52, 40, 00, 8B, 0D, BC, 7A, 40, 00, 89, 08, A1, 0C, 52, 40, 00, 8B, 00, A3, C8, 7A, 40, 00, E8, 90, 01, 00, 00, 39, 1D, 70, 70, 40, 00, 75, 0C, 68, 8A, 41, 40, 00, FF, 15...
 
[+]

Entropy:
7.4754

Developed / compiled with:
Microsoft Visual C++

Remove updateflashplayer_4e78b51a.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.