Categories: Malware

Zusy.11009 information

The Zusy.11009 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Zusy.11009 virus can do?

Behavioural detection: Executable code extraction – unpacking
Creates RWX memory
Dynamic (imported) function loading detected
CAPE extracted potentially suspicious content
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid
Tries to unhook or modify Windows functions monitored by Cuckoo
Spoofs its process name and/or associated pathname to appear as a legitimate process

How to determine Zusy.11009?


File Info:
name: EB187A6D00F404F2B2FB.mlwpath: /opt/CAPEv2/storage/binaries/9f7179bb86a90356cc5762f89480ac580fd94bd5e309fbc9acc26cd71b49bb6fcrc32: F065030Bmd5: eb187a6d00f404f2b2fbf9ce38f540bdsha1: b044cac4e0ee1068419531b32f9894a94751fb30sha256: 9f7179bb86a90356cc5762f89480ac580fd94bd5e309fbc9acc26cd71b49bb6fsha512: 5c7d22527ee8d9070a82d3735de0f36b2ff2f1ce2c7edff9468a880338947358b26cc21d212617edc8bbb2c73b941b3c493c25880610c7a5c8278acdd346f37fssdeep: 6144:pCa2D1MH3pIHHDW0tecq0/qFBZBrbKoWTZtFekSPWrhbEd7TqumIaatQdOrRoS5M:pCa2hm3pIHi0Jq0/qNB/CTPAUN6qutATtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1FD74237BA5C458A6C0F7053948CC335903012FAAEF97D4372E7670DB666406AAE2C5DEsha3_384: af07f44e77cc2e1ff385f37dbf53608a12dc9dadb10b3cf27ef5ba6f60cd819177fc322ad2e0d8323f07a7d882b7f779ep_bytes: 558bec83e4f881eca40c0000535657e8timestamp: 1970-01-01 00:00:39
Version Info:
Comments: CompanyName: FileDescription: FileVersion: 1.0.0.0InternalName: bt.exeLegalCopyright: OriginalFilename: bt.exeProductName: ProductVersion: 1.0.0.0

Zusy.11009 also known as:

Bkav	W32.AIDetect.malware2
tehtris	Generic.Malware
DrWeb	Trojan.PWS.Panda.786
MicroWorld-eScan	Gen:Variant.Zusy.11009
FireEye	Generic.mg.eb187a6d00f404f2
ALYac	Gen:Variant.Zusy.11009
Cylance	Unsafe
Sangfor	Spyware.Win32.Zbot.bopd
K7AntiVirus	Spyware ( 004b8a241 )
Alibaba	TrojanSpy:Win32/Crypt.201e62be
K7GW	Spyware ( 004b8a241 )
Cybereason	malicious.d00f40
BitDefenderTheta	Gen:NN.ZexaF.34638.vy3@aexx7se
Cyren	W32/Trojan.WTPB-0146
Symantec	Trojan Horse
Elastic	malicious (high confidence)
ESET-NOD32	Win32/Spy.Zbot.YW
Paloalto	generic.ml
ClamAV	Win.Trojan.Zbot-20083
Kaspersky	Trojan-Spy.Win32.Zbot.bopd
BitDefender	Gen:Variant.Zusy.11009
NANO-Antivirus	Trojan.Win32.Zbot.trtvi
Avast	Sf:Crypt-BT [Trj]
Tencent	Malware.Win32.Gencirc.10b68dc9
Ad-Aware	Gen:Variant.Zusy.11009
Sophos	Troj/Mdrop-EMP
Comodo	Malware@#1hsuiprcpnzjw
Zillya	Trojan.Zbot.Win32.49374
McAfee-GW-Edition	BehavesLike.Win32.Generic.fc
Emsisoft	Gen:Variant.Zusy.11009 (B)
SentinelOne	Static AI – Suspicious PE
Jiangmin	TrojanSpy.Zbot.bldk
Webroot	W32.Malware.Gen
Avira	TR/Crypt.XPACK.Gen7
MAX	malware (ai score=99)
Microsoft	PWS:Win32/Zbot
ViRobot	Trojan.Win32.A.Zbot.350781
GData	Gen:Variant.Zusy.11009
Cynet	Malicious (score: 100)
AhnLab-V3	Spyware/Win32.Zbot.R34306
McAfee	Artemis!EB187A6D00F4
TACHYON	Trojan-Spy/W32.ZBot.358458
VBA32	TrojanSpy.Zbot
APEX	Malicious
Rising	Spyware.Zbot!8.16B (CLOUD)
Yandex	Trojan.XPACK!QidNEvsoLdU
Ikarus	Trojan-Spy.Win32.Zbot
MaxSecure	Trojan.Malware.2183458.susgen
Fortinet	W32/Zbot.BOPD!tr
AVG	Sf:Crypt-BT [Trj]
Panda	Generic Malware
CrowdStrike	win/malicious_confidence_100% (W)