Trojan:Win32/Zusy.B!MTB removal

The Trojan:Win32/Zusy.B!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan:Win32/Zusy.B!MTB virus can do?

SetUnhandledExceptionFilter detected (possible anti-debug)
Possible date expiration check, exits too soon after checking local time
Dynamic (imported) function loading detected
Authenticode signature is invalid

How to determine Trojan:Win32/Zusy.B!MTB?


File Info:
name: 178A5A4F825129D43C42.mlw
path: /opt/CAPEv2/storage/binaries/cd46a6f659f08fd4408545a9b361cc2adb0be43a1b18283434cbb0c617405092
crc32: 6B0A8E02
md5: 178a5a4f825129d43c426a2c1a7fcfd6
sha1: 03e525a2cd6445e529f5949aebee256793dc9a37
sha256: cd46a6f659f08fd4408545a9b361cc2adb0be43a1b18283434cbb0c617405092
sha512: bbb89fa4c3a719c722999661ae1c63c3df7cdaa2e6ba11fe90f3c2985df4feea7dcf51dd8909609beaa483fbd1f22d7721acad0cf14180dad735c54b5d1c19f1
ssdeep: 3072:BSS6mfc/fqJRXSwiLVdovwcVwiB6DvFAEb9doa7uvZkZZfxWd8UxrhzMRkF:oS6w8yXqRMwTiSF1oSuvZknOF5F
type: PE32 executable (console) Intel 80386, for MS Windows
tlsh: T133546A113AC2C432D872163514B4DFB1966DEE381F70CA9B27E05E3BFE346D21D24A6A
sha3_384: ecc63180c3358d1846813a2bb904ef2c8ccb234c4cc7ce23b46efae8ddcd33ec29e59a37b78cbaab657670155fafd7ee
ep_bytes: e8a7050000e974feffff558bec6a00ff
timestamp: 2022-06-29 04:28:15

Version Info:
FileVersion: 1.0.0.0
LegalCopyright: 2020-2022 All rights reserved
Translation: 0x0409 0x04b0

Trojan:Win32/Zusy.B!MTB also known as:

Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
FireEye	Generic.mg.178a5a4f825129d4
McAfee	GenericRXRN-NG!178A5A4F8251
VIPRE	Gen:Variant.Zusy.417393
Cyren	W32/Agent.EBL.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Agent_AGen.VV
APEX	Malicious
ClamAV	Win.Malware.Zusy-9952511-0
Kaspersky	HEUR:Trojan.Win32.Agent.gen
BitDefender	Gen:Variant.Zusy.417393
NANO-Antivirus	Trojan.Win32.AgentAGen.jpjife
SUPERAntiSpyware	Trojan.Agent/Gen-Zusy
MicroWorld-eScan	Gen:Variant.Zusy.417393
Avast	Win32:PWSX-gen [Trj]
Tencent	Backdoor.Win32.Convagent.wb
Ad-Aware	Gen:Variant.Zusy.417393
Emsisoft	Gen:Variant.Zusy.417393 (B)
F-Secure	Heuristic.HEUR/AGEN.1213174
Zillya	Trojan.AgentAGen.Win32.3607
McAfee-GW-Edition	BehavesLike.Win32.Generic.dt
Sophos	Generic ML PUA (PUA)
GData	Win32.Trojan.PSE1.W0A0BD
Jiangmin	Trojan.Multi.ieu
Avira	HEUR/AGEN.1213174
MAX	malware (ai score=84)
Antiy-AVL	Trojan/Win32.Wacatac
Arcabit	Trojan.Zusy.D65E71
ZoneAlarm	HEUR:Trojan.Win32.Agent.gen
Microsoft	Trojan:Win32/Zusy.B!MTB
AhnLab-V3	Trojan/Win.NG.C5147392
ALYac	Gen:Variant.Zusy.417393
Malwarebytes	Malware.AI.447383033
Rising	Trojan.Generic@AI.100 (RDML:71sUy5J1TU3akHCEvTtpDA)
Yandex	Trojan.Agent!HLqzUHz2HNI
Ikarus	Trojan.Win32.Agent
Fortinet	W32/Agent.VV!tr
AVG	Win32:PWSX-gen [Trj]
Panda	Trj/GdSda.A

How to remove Trojan:Win32/Zusy.B!MTB?

Trojan:Win32/Zusy.B!MTB removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X