Should I remove “Trojan:MSIL/Zusy.AF!MTB”?

The Trojan:MSIL/Zusy.AF!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan:MSIL/Zusy.AF!MTB virus can do?

CAPE extracted potentially suspicious content
Authenticode signature is invalid
Binary compilation timestomping detected

How to determine Trojan:MSIL/Zusy.AF!MTB?


File Info:
name: 84FB785C1A8F3DACF77C.mlw
path: /opt/CAPEv2/storage/binaries/f2b523799fcf9f6a5dabc2e118b179ab4f58d7306ef818b0c15d8653c2020985
crc32: 57DC8C55
md5: 84fb785c1a8f3dacf77c09eed24d28c6
sha1: 881cc4d033b70470eb3a5c001097a6d02bca3749
sha256: f2b523799fcf9f6a5dabc2e118b179ab4f58d7306ef818b0c15d8653c2020985
sha512: 4a1213fd0a0c4c44f9cb197fe0ac5ef56b42711e3ad49dc7b05a01aa62925d86f5a5415320495e546aaa009dec609f1baeb4ff34ca9ed579ef3e4686b1c23904
ssdeep: 192:s0JFMwQm27GOw2D1t4oTcIW1CnhrMsWUgNTOBOGHfJ6O:sMCwQm2ajqtLTDnhrMsvOTZGHfQO
type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
tlsh: T18D12062197D48237D9BB1F725C23675106B6E200CA67CF3E08D4D1294CA73884BA3BB2
sha3_384: c2d1b567531912575948432755863202d97a10a81acfc1b1ffe5057bd38b861161e3077402bff9f12a43deb342245a55
ep_bytes: ff250020001000000000000000000000
timestamp: 2038-09-11 14:57:25

Version Info:
Translation: 0x0000 0x04b0
Comments: 
CompanyName: 
FileDescription: 
FileVersion: 1.0.0.0
InternalName: ClassLibrary3.dll
LegalCopyright: Copyright ©  2022
LegalTrademarks: 
OriginalFilename: ClassLibrary3.dll
ProductName: 
ProductVersion: 1.0.0.0
Assembly Version: 1.0.0.0

Trojan:MSIL/Zusy.AF!MTB also known as:

Bkav	W32.Common.08994E36
Lionic	Trojan.Win32.Generic.4!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Zusy.520631
Skyhigh	RDN/Generic Dropper
McAfee	RDN/Generic Dropper
Cylance	unsafe
Sangfor	Dropper.Msil.Zusy.Veqc
K7AntiVirus	Trojan-Downloader ( 0058c6651 )
BitDefender	Gen:Variant.Zusy.520631
K7GW	Trojan-Downloader ( 0058c6651 )
CrowdStrike	win/malicious_confidence_60% (W)
Symantec	Trojan.Gen.MBT
ESET-NOD32	a variant of MSIL/TrojanDownloader.Small.DBZ
TrendMicro-HouseCall	TROJ_GEN.R011C0DA724
Kaspersky	HEUR:Trojan-Downloader.MSIL.Agent.gen
Avast	Win32:DropperX-gen [Drp]
Emsisoft	Gen:Variant.Zusy.520631 (B)
F-Secure	Trojan.TR/Redcap.jlfbi
TrendMicro	TROJ_GEN.R011C0DA724
FireEye	Gen:Variant.Zusy.520631
Sophos	Mal/Generic-S
Ikarus	Trojan-Downloader.MSIL.Agent
MAX	malware (ai score=81)
Google	Detected
Avira	TR/Redcap.jlfbi
Varist	W32/MSIL_Dldr.D.gen!Eldorado
Antiy-AVL	Trojan/Win32.Wacatac
Microsoft	Trojan:MSIL/Zusy.AF!MTB
Arcabit	Trojan.Zusy.D7F1B7
ZoneAlarm	HEUR:Trojan-Downloader.MSIL.Agent.gen
GData	Gen:Variant.Zusy.520631
AhnLab-V3	Dropper/Win.Generic.C5565946
ALYac	Gen:Variant.Zusy.520631
Malwarebytes	Trojan.Crypt.MSIL.Generic
Panda	Trj/Chgt.AD
SentinelOne	Static AI – Suspicious PE
Fortinet	W32/PossibleThreat
AVG	Win32:DropperX-gen [Drp]
DeepInstinct	MALICIOUS

How to remove Trojan:MSIL/Zusy.AF!MTB?

Trojan:MSIL/Zusy.AF!MTB removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X