Categories: Malware

Ser.Zusy.4178 (B) removal guide

The Ser.Zusy.4178 (B) is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Ser.Zusy.4178 (B) virus can do?

Sample contains Overlay data
HTTPS urls from behavior.
Drops a binary and executes it
Authenticode signature is invalid
Uses Windows utilities for basic functionality
Uses Windows utilities to create a scheduled task
Attempts to identify installed AV products by installation directory
Attempts to modify proxy settings
Appears to use command line obfuscation
Creates a copy of itself
Uses suspicious command line tools or Windows utilities

How to determine Ser.Zusy.4178 (B)?


File Info:
name: D9691EE85CC32FF9B36C.mlwpath: /opt/CAPEv2/storage/binaries/2ddd4837ee68e741fd262468000811ff52b968aaff0ddec9d124f0dec379d481crc32: 468D6DF3md5: d9691ee85cc32ff9b36c47fd9ae7d850sha1: 2e939bce3921abe4329e69e5ee759b17bcad2487sha256: 2ddd4837ee68e741fd262468000811ff52b968aaff0ddec9d124f0dec379d481sha512: 090a827fbb4d174fb5e6d831f14967799f118628f0f305706262e46cc47832dc2efe3cf2dc2771756ebd37c7840bed550cd0a409dab21e4d209a366401c3e646ssdeep: 3072:3vtV3ROZ6RDwrR3wMUzUVwQ3rInyRnIvPak3hhiHFSbuZhuNcZVKBzqm8LHIkbGB:ftV3euVz6rKyS3yHFHhuNcPKpwU+type: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1D72408557812C032D56061762DB5BFF2C59DA828ABB049DB7B800F77DA112F73A70E3Asha3_384: 0bbc9d0e12e8a6972ac64fa8d366eda0c65d63d9047562f587dced00db8252db17b8725d1517bc18674838904d1141d2ep_bytes: e884040000e974feffffe9ac41000055timestamp: 2023-07-24 12:21:28
Version Info:
0: [No Data]

Ser.Zusy.4178 (B) also known as:

Bkav	W32.AIDetectMalware
Elastic	Windows.Trojan.Amadey
DrWeb	Trojan.DownLoader45.62430
MicroWorld-eScan	Gen:Variant.Ser.Zusy.4178
ClamAV	Win.Malware.Doina-10001799-0
FireEye	Generic.mg.d9691ee85cc32ff9
ALYac	Gen:Variant.Ser.Zusy.4178
Cylance	unsafe
Sangfor	Suspicious.Win32.Save.a
Cybereason	malicious.85cc32
BitDefenderTheta	AI:Packer.2CDFB55E1F
Cyren	W32/Amadey.C1.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/TrojanDownloader.Amadey.A
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	HEUR:Trojan-Spy.Win32.Stealer.gen
BitDefender	Gen:Variant.Ser.Zusy.4178
Avast	Win32:Evo-gen [Trj]
Emsisoft	Gen:Variant.Ser.Zusy.4178 (B)
F-Secure	Heuristic.HEUR/AGEN.1317762
VIPRE	Gen:Variant.Ser.Zusy.4178
McAfee-GW-Edition	BehavesLike.Win32.Generic.dh
Trapmine	suspicious.low.ml.score
Ikarus	Trojan-Downloader.Win32.Amadey
GData	Gen:Variant.Ser.Zusy.4178
Jiangmin	TrojanDownloader.Deyma.aqt
Avira	HEUR/AGEN.1317762
Arcabit	Trojan.Ser.Zusy.D1052
ZoneAlarm	HEUR:Trojan-Spy.Win32.Stealer.gen
Microsoft	Trojan:Win32/Amadey.RPX!MTB
Google	Detected
AhnLab-V3	Trojan/Win.Amadey.C5459518
McAfee	Downloader-FCND!D9691EE85CC3
MAX	malware (ai score=84)
Panda	Trj/Genetic.gen
Rising	Downloader.Amadey!8.125AC (TFE:5:RZlUpeBEt9L)
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/Amadey.A!tr
AVG	Win32:Evo-gen [Trj]
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_100% (D)