Classification: Malicious
za.ebali is a malicious file sample. Linked to Trickbot malware. Reported by 2 threat sources, last seen 2026-09-02. Detected by 46 antivirus engines.
Detection summary
- 46 antivirus detections (66% detection ratio)
- 0 IDS alerts
- 9 processes observed
- 0 contacted hosts
- 0 DNS requests
Blacklist sightings
| Description |
Source |
First seen |
Last seen |
Labels |
MITRE ATT&CK |
| Trickbot |
Triage |
2026-06-03 06:15:56 |
2026-09-02 12:25:59 |
malicious-activity
|
S0266 TrickBot
|
| Trojan.Trickster |
Hybrid-Analysis |
2019-04-10 07:45:17 |
2019-04-10 07:45:17 |
|
|
Tags
trickbot
banker
discovery
persistence
trojan
defense_evasion
evasion
execution
Sample information
- Filenames
- za.ebali, za.exe
- File type
- PE32 executable (GUI) Intel 80386, for MS Windows
- Size
- 250880 bytes
- MD5
df1c41e06b3ff62b7963e380d0b3b26d- SHA-1
8464908b53d3f00f2aebaecd842fd205bb0cbab7- SHA-256
da252efc670493820e953a0472959d21ca2dd85b2d4ed25b693d1ced25a02fbd- First indexed
- 2019-04-10 07:45:17
- Last updated
- 2026-09-02 12:57:11
Antivirus detections
| Engine | Detection |
|---|
| MicroWorld-eScan | Trojan.GenericKD.31757651 |
| CAT-QuickHeal | Trojan.Trickster |
| McAfee | RDN/Generic.grp |
| Cylance | Unsafe |
| BitDefender | Trojan.GenericKD.31757651 |
| K7GW | Riskware ( 0040eff71 ) |
| K7AntiVirus | Riskware ( 0040eff71 ) |
| TrendMicro | TrojanSpy.Win32.TRICKBOT.THCAAAI |
| Symantec | Trojan Horse |
| TrendMicro-HouseCall | TrojanSpy.Win32.TRICKBOT.THCAAAI |
| Avast | Win32:Malware-gen |
| GData | Trojan.GenericKD.31757651 |
| Kaspersky | Trojan-Banker.Win32.Trickster.bfc |
| Alibaba | TrojanBanker:Win32/Trickster.62032f43 |
| NANO-Antivirus | Trojan.Win32.Trickster.fnwdri |
| ViRobot | Trojan.Win32.Trickbot.250880 |
| AegisLab | Trojan.Win32.Trickster.4!c |
| Rising | Trojan.MereTam!8.E4CE (CLOUD) |
| Endgame | malicious (high confidence) |
| Sophos | Troj/Trickbo-PR |
| Comodo | Malware@#29gn9irbotx9c |
| DrWeb | Trojan.Trick.46210 |
| McAfee-GW-Edition | BehavesLike.Win32.PUPXFQ.dc |
| Emsisoft | Trojan.Agent (A) |
| Ikarus | Trojan-Spy.Agent |
| Cyren | W32/Trojan.ZDBU-5317 |
| Webroot | W32.Trickbot |
| MAX | malware (ai score=99) |
| Antiy-AVL | Trojan[Banker]/Win32.Trickster |
| Microsoft | Trojan:Win32/MereTam.A |
| Arcabit | Trojan.Generic.D1E49553 |
| ZoneAlarm | Trojan-Banker.Win32.Trickster.bfc |
| AhnLab-V3 | Malware/Gen.Generic.C3076615 |
| Acronis | suspicious |
| VBA32 | BScope.Trojan.Trick |
| ALYac | Trojan.Trickster.Gen |
| Ad-Aware | Trojan.GenericKD.31757651 |
| Panda | Trj/GdSda.A |
| ESET-NOD32 | Win32/TrickBot.BW |
| Tencent | Win32.Trojan-banker.Trickster.Wska |
| Yandex | Trojan.PWS.Trickster! |
| SentinelOne | DFI - Malicious PE |
| Fortinet | Malicious_Behavior.SB |
| AVG | Win32:Malware-gen |
| Paloalto | generic.ml |
| Qihoo-360 | Win32/Trojan.76d |
Process list
| Name | Command line |
|---|
| za.exe | |
| cmd.exe | /c sc stop WinDefend |
| sc.exe | sc stop WinDefend |
| cmd.exe | /c sc delete WinDefend |
| sc.exe | sc delete WinDefend |
| cmd.exe | /c powershell Set-MpPreference -DisableRealtimeMonitoring $true |
| powershell.exe | powershell Set-MpPreference -DisableRealtimeMonitoring $true |
| za.exe | |
| svchost.exe | |