This is because while all Windows executables start with the bytes “MZ” – the updated Zeus variant starts with “ZZP” and are delivered as an .ENC file.

When the JS file is executed, it will download the TorrentLocker executable, save it to the %Temp% folder, and execute it. Once executed, it will encrypt the computer's data and append the .

In most cases, until the malware itself initiates and triggers behavioral red flags, most AV solutions will treat the .ENC file as harmless. Next read this The 10 most powerful cybersecurity companies ...