BKDR_TZEEBOT.A
TrojanSpy:MSIL/Tzeebot (Microsoft), Trojan-Cleaver (McAfee), Trojan.Tzeebot (Symantec), MSIL/Spy.TzeeBot.C (ESET), MSIL:Tzeebot-A [Trj] (Avast)
Windows
![](/vinfo/imgFiles/legend.jpg)
Threat Type: Backdoor
Destructiveness: No
Encrypted: No
In the wild: Yes
OVERVIEW
Dropped by other malware
This backdoor may be dropped by other malware.
It executes commands from a remote malicious user, effectively compromising the affected system.
It exports functions used by other malware. It requires its main component to successfully perform its intended routine.
TECHNICAL DETAILS
Varies
DLL
No
10 Dec 2015
Arrival Details
This backdoor may be dropped by other malware.
Backdoor Routine
This backdoor executes the following commands from a remote malicious user:
- Copy a file
- Delete a file
- Terminate self
- Upload a file
- Compute the MD5 hash of a file
- Capture screenshot
- Update configuration file
- Restart self
- Execute a program
Other Details
This backdoor exports functions used by other malware.
It requires its main component to successfully perform its intended routine.
SOLUTION
9.750
11.334.02
10 Dec 2015
11.335.00
11 Dec 2015
Scan your computer with your Trend Micro product to delete files detected as BKDR_TZEEBOT.A. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.
Did this description help? Tell us how we did.