Trojan-Spy.Win32.Zbot.aatwr

Trojan-SpyWin32
Detection added: 12.11.2026 17:09:00 (GMT+2)
MD5: EACE41FB5E3CE83D061D6AF7BA2B4E5C
SHA1: 58CFC4B6B62E3D87070AF60CA0269D24CC74CF23

Behavior: Trojan Program (Trojan Spy)

Spies on the user: records keystrokes, takes screenshots, collects information about running applications and sends it to the attacker. They are designed to steal your passwords and other sensitive information.

Platform: Win32

This malware is in the Portable Executable (PE) format — a file format for executables, object code, DLLs, FON font files, and others used in 32-bit and 64-bit versions of Windows.

Systems affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP, Windows Vista, Windows 7 (x86/x64), Windows 8 (x86/x64), Windows 10 (x86/x64), Windows 11 (x86/x64)

NOTE: The hash is only listed for the first detected malicious file. SHA/MD5 hash is not intended as a security/antivirus solution; it provides additional information that allows you to identify known malware files.

How to prevent infection

  • Use up-to-date antivirus software.
  • Install the latest updates for your operating system and installed software.
  • Use strong passwords and password management software.
  • Use caution when opening attachments, accepting file transfers and clicking on links to web pages.

Learn more