Trojan-Spy.Win32.Zbot.qupq

Trojan-Spy.Win32.Zbot.qupq also known as Trojan.Zbot, Win32/Zbot.HVV, Malware.QVM20.Gen.

Malware Analysis of Trojan-Spy.Win32.Zbot.qupq

Created files:

%Appdata%\Microsoft\Address Book\Administrator.wab
%Appdata%\Sienbi\ruhiiv.exe

Autostart registry keys:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Ruhiiv: “”%Appdata%\Sienbi\ruhiiv.exe””

Detected by UnHackMe:

RUHIIV.EXE
Default location: %APPDATA%\SIENBI\RUHIIV.EXE

Dropper hash(md5): a8c57b6b159dae911e72e34555f0e0f8

Written by 

Malware Hunter.

Leave a Reply

WordPress SEO fine-tune by Meta SEO Pack from Poradnik Webmastera