Categories: Malware

Zusy.2323 (file analysis)

The Zusy.2323 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Zusy.2323 virus can do?

Sample contains Overlay data
Unconventionial binary language: Chinese (Simplified)
Unconventionial language used in binary resources: Chinese (Simplified)
Authenticode signature is invalid
CAPE detected the shellcode get eip malware family
Yara detections observed in process dumps, payloads or dropped files

How to determine Zusy.2323?


File Info:
name: D74BBE5629602FFCF3CF.mlwpath: /opt/CAPEv2/storage/binaries/02418a66175a94da67e98f2a16c8522371f06957e4af63c29feb63779ef3734fcrc32: 46B570D6md5: d74bbe5629602ffcf3cf5ff26e1c86d9sha1: 2481d53482587ade594b8182f68b20a5e7d89916sha256: 02418a66175a94da67e98f2a16c8522371f06957e4af63c29feb63779ef3734fsha512: a81a0542e063fef3c2d51eea44e8930524d3b313c959b5c7508a76c54ec78269eb22aa106949fe3b931e9ed246e8e615ce7f4c2f123d726b4748d81caeee8d03ssdeep: 3072:7OZnuQq5hlJCalDoG6MyeY/mDi/61ulAnKqn5lxoUgoMJYa4mOmVkLrOWjrA:l5hDCrMyeY/mDXnneU7MR4mOrLaWjrAtype: PE32 executable (DLL) (GUI) Intel 80386, for MS Windowstlsh: T13434BE22F556C5B1C48D127C0987137DA33EAC01AF615AE39B48FB6DA9723D09E36287sha3_384: 3c368cf6e0af8ebb6a2e072b32d0af958552666550f7bd1e3708214a7285f8ad39aa7dacb74499465f7d30aa583aa2cbep_bytes: 6a0c68305c0110e87901000033c04089timestamp: 2010-09-27 09:21:28
Version Info:
CompanyName: Beijing Angels Technology ltd.FileDescription: IE Media ObjectFileVersion: 1.0.0.1InternalName: BHO.dllLegalCopyright: Beijing Angels Technology ltd.  All rights reserved.OriginalFilename: b.dllProductName: IE Media ObjectProductVersion: 1.0.0.1Translation: 0x0804 0x03a8

Zusy.2323 also known as:

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Kykymber.lmDX
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Zusy.2323
FireEye	Generic.mg.d74bbe5629602ffc
Skyhigh	BehavesLike.Win32.Infected.dh
McAfee	GenericRXAC-BO!D74BBE562960
Cylance	unsafe
Zillya	Adware.BHO.Win32.4355
Sangfor	Suspicious.Win32.Save.ins
CrowdStrike	win/malicious_confidence_90% (W)
Alibaba	TrojanDownloader:Win32/Adnur.3288e2bf
K7GW	Adware ( 004faa4d1 )
K7AntiVirus	Adware ( 004faa4d1 )
BitDefenderTheta	Gen:NN.ZedlaF.36802.om@@aezWtFlj
VirIT	Adware.Win32.Benega.EHT
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Adware.WSearch.AQ
APEX	Malicious
TrendMicro-HouseCall	TROJ_AGENT_008173.TOMB
ClamAV	Win.Adware.Bho-2009
Kaspersky	Trojan-Downloader.Win32.Adnur.won
BitDefender	Gen:Variant.Zusy.2323
NANO-Antivirus	Riskware.Win32.BHO.dusqx
Avast	Win32:BHO-ADO [Adw]
Tencent	Malware.Win32.Gencirc.1165d223
Sophos	Troj/BHO-QJ
F-Secure	Trojan.TR/Crypt.XPACK.Gen
DrWeb	Adware.Benega.2905
VIPRE	Gen:Variant.Zusy.2323
TrendMicro	TROJ_AGENT_008173.TOMB
Emsisoft	Gen:Variant.Zusy.2323 (B)
Ikarus	Trojan-Downloader.Win32.Adnur
Jiangmin	Adware/BHO.bue
Google	Detected
Avira	TR/Crypt.XPACK.Gen
Varist	W32/AdLoad.I.gen!Eldorado
Antiy-AVL	GrayWare[AdWare]/Win32.BHO
Kingsoft	Win32.Troj.Undef.a
Microsoft	PUA:Win32/Bitrepeyp.B
Xcitium	TrojWare.Win32.TrojanProxy.Puma.jsjg@3gzr6m
Arcabit	Trojan.Zusy.D913
ZoneAlarm	Trojan-Downloader.Win32.Adnur.won
GData	Win32.Trojan.PSE.N540AG
Cynet	Malicious (score: 100)
VBA32	Trojan.BHORA
ALYac	Gen:Variant.Zusy.2323
MAX	malware (ai score=90)
Malwarebytes	Generic.Malware.AI.DDS
Panda	Trj/Genetic.gen
Rising	Backdoor.Win32.Undef.gxf (CLASSIC)
Yandex	Trojan.GenAsa!iKSPMWaHhcQ
SentinelOne	Static AI – Malicious PE
Fortinet	Adware/BHO
AVG	Win32:BHO-ADO [Adw]
DeepInstinct	MALICIOUS
alibabacloud	Trojan