Trojan

Trojan:Win32/Zusy.ASJ!MTB malicious file

Malware Removal

The Trojan:Win32/Zusy.ASJ!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Trojan:Win32/Zusy.ASJ!MTB virus can do?

  • Sample contains Overlay data
  • Unconventionial binary language: Chinese (Simplified)
  • Unconventionial language used in binary resources: Chinese (Simplified)
  • The binary contains an unknown PE section name indicative of packing
  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid

How to determine Trojan:Win32/Zusy.ASJ!MTB?


File Info:

name: E0C67C389C1C865DA2F2.mlw
path: /opt/CAPEv2/storage/binaries/bf924cdfb9545987ea4e5060438c5c1e01e0b6c9e1aaa7d1d4369a93e33b46ed
crc32: D7348102
md5: e0c67c389c1c865da2f24d68213a35e5
sha1: 0eac378b2735aea8b4bdc76a05d1152197bd1a9f
sha256: bf924cdfb9545987ea4e5060438c5c1e01e0b6c9e1aaa7d1d4369a93e33b46ed
sha512: 390e70f6d529a6096033113ecc8ebe4ec1a7ff67101b5ee0687876ad811163af43feaf06f9acda7b7120aba6e0cb9826319bf3ad36a9b2f5192ff956dd5886a9
ssdeep: 12288:uebcm07qSbxTA62RpTS4TeP7xak+lzSvHrB/UxmkRWvi+RL2mnzYYNnfYNZ0ts1I:DfkBbxTPEpTS42xaBlzSvHrBsxmkRWvB
type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
tlsh: T1CFC4BF11D1404D37E276AEF08CAF32EEEA2E1AF22638717D41F6274216113B9B5667C7
sha3_384: 7c6b787bda10c9d3830e1f7f0bf40f292a408491d45a5d85d9cbb1631ca22d7ac32fc9ea90fd84f3c7295bf760089833
ep_bytes: 558bec83c4c4b8d8b74100e8f4a0feff
timestamp: 1992-06-19 22:22:17

Version Info:

CompanyName: 风-之恋
FileDescription: 风-之恋 工作室。
FileVersion: 1.0.1.0
InternalName:
LegalCopyright: Copyright 风-之恋 工作室 @2010.
LegalTrademarks:
OriginalFilename:
ProductName: 风-之恋
ProductVersion: 1.0.0.0
Comments:
Translation: 0x0804 0x03a8

Trojan:Win32/Zusy.ASJ!MTB also known as:

BkavW32.AIDetectMalware
LionicTrojan.Win32.Generic.m3tg
MicroWorld-eScanTrojan.Agent.GHZQ
FireEyeGeneric.mg.e0c67c389c1c865d
SkyhighBehavesLike.Win32.Corrupt.hc
ALYacTrojan.Agent.GHZQ
MalwarebytesSpatet.Backdoor.Bot.DDS
SangforTrojan.Win32.Save.a
K7AntiVirusRiskware ( 00584baa1 )
AlibabaTrojan:Win32/AgentMB.eea80126
K7GWRiskware ( 00584baa1 )
CrowdStrikewin/malicious_confidence_100% (W)
SymantecML.Attribute.HighConfidence
Elasticmalicious (high confidence)
ESET-NOD32a variant of Generik.FULIRGG
CynetMalicious (score: 100)
APEXMalicious
ClamAVWin.Packed.Generic-10014311-0
BitDefenderTrojan.Agent.GHZQ
AvastWin32:Malware-gen
TencentMalware.Win32.Gencirc.10bf5ed5
TACHYONTrojan/W32.DP-Agent.573960
EmsisoftTrojan.Agent.GHZQ (B)
F-SecureTrojan.TR/Crypt.XPACK.Gen
VIPRETrojan.Agent.GHZQ
TrendMicroTROJ_GEN.R002C0DC724
Trapminemalicious.high.ml.score
SophosMal/Generic-S
IkarusTrojan.AgentMB
VaristW32/ABTrojan.RJIL-1776
AviraTR/Crypt.XPACK.Gen
Antiy-AVLTrojan/Win32.SGeneric
Kingsoftmalware.kb.a.999
MicrosoftTrojan:Win32/Zusy.ASJ!MTB
ArcabitTrojan.Agent.GHZQ
GDataTrojan.Agent.GHZQ
GoogleDetected
AhnLab-V3Trojan/Win.Generic.R622404
McAfeeRDN/Generic.dx
MAXmalware (ai score=85)
Cylanceunsafe
PandaTrj/Genetic.gen
TrendMicro-HouseCallTROJ_GEN.R002C0DC724
RisingTrojan.Generic@AI.100 (RDML:Zw0sDKN82Rc7rGK/W5SnhQ)
YandexTrojan.Agent!4HfxwsmlTzg
SentinelOneStatic AI – Malicious PE
MaxSecureTrojan.Malware.220329519.susgen
FortinetW32/PossibleThreat
AVGWin32:Malware-gen
DeepInstinctMALICIOUS
alibabacloudVirTool:Win/Obfuscate.SMC.Hep(dyn)

How to remove Trojan:Win32/Zusy.ASJ!MTB?

Trojan:Win32/Zusy.ASJ!MTB removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment