Categories: Malware

Zusy.289617 (file analysis)

The Zusy.289617 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Zusy.289617 virus can do?

Executable code extraction
Creates RWX memory
Unconventionial binary language: Chinese (Simplified)
Unconventionial language used in binary resources: Chinese (Simplified)
The binary likely contains encrypted or compressed data.
The executable is likely packed with VMProtect
Network activity detected but not expressed in API logs

Related domains:

z.whorecord.xyz

How to determine Zusy.289617?


File Info:
crc32: 7689AC84md5: b63c6ffc4f3926518e4904b6f00022bename: ll773o.exesha1: 054a1a6ac5cd3a616935ba783456cfc95a65652csha256: c2a2f6526b9f10d7af36254007a0eb4b222db8ece07dc887dbbb2124f6d39692sha512: 6b52986e5af5488a13c262e995bcfac860209f9e809c23ed64c5330ba05ef4a1592abc032586645044015590902d0c5ee9d533c089694d608e5d8a7c52423cf6ssdeep: 12288:CqGw1T2nYgCnLMfwcd5R6XgaEX0V/R8lnLvDbbDZM+eotreVySjA5UL9E:CqGY+CLwXR6KIUnXDS+eotrGjL9Etype: PE32 executable (GUI) Intel 80386, for MS Windows
Version Info:
Translation: 0x0804 0x04b0InternalName: QQFileVersion: 1.00CompanyName: ChinaProductName: x5de5x7a0b1ProductVersion: 1.00OriginalFilename: QQ.exe

Zusy.289617 also known as:

Bkav	HW32.Packed.
MicroWorld-eScan	Gen:Variant.Zusy.289617
FireEye	Generic.mg.b63c6ffc4f392651
McAfee	Generic-FAAF!B63C6FFC4F39
Cylance	Unsafe
Sangfor	Malware
CrowdStrike	win/malicious_confidence_100% (W)
BitDefender	Gen:Variant.Zusy.289617
K7GW	Trojan ( 00006f8a1 )
Invincea	heuristic
BitDefenderTheta	AI:Packer.070809441F
APEX	Malicious
Avast	Win32:Trojan-gen
GData	Gen:Variant.Zusy.289617
Kaspersky	HEUR:Trojan.Win32.Generic
Alibaba	VirTool:Win32/Obfuscator.d383c96f
AegisLab	Trojan.Win32.Generic.4!c
Tencent	Trojan.Win32.FakeApp.b
Endgame	malicious (high confidence)
Sophos	Mal/VMProtBad-A
F-Secure	Trojan.TR/Black.Gen2
Baidu	Win32.Trojan.KryptikV.g
TrendMicro	TROJ_GEN.R002C0CCH20
McAfee-GW-Edition	BehavesLike.Win32.Generic.bc
Trapmine	malicious.high.ml.score
Emsisoft	Gen:Variant.Zusy.289617 (B)
Ikarus	VirTool.Win32.Obfuscator
Avira	TR/Black.Gen2
Webroot	W32.Malware.gen
MAX	malware (ai score=80)
Arcabit	Trojan.Zusy.D46B51
ZoneAlarm	HEUR:Trojan.Win32.Generic
Microsoft	VirTool:Win32/Obfuscator.XZ
AhnLab-V3	Trojan/Win32.Strictor.C916130
Acronis	suspicious
ALYac	Gen:Variant.Zusy.289617
Panda	Trj/Genetic.gen
ESET-NOD32	a variant of Win32/Packed.VMProtect.AAH
TrendMicro-HouseCall	TROJ_GEN.R002C0CCH20
Rising	Trojan.Generic!8.C3 (CLOUD)
SentinelOne	DFI – Suspicious PE
eGambit	Unsafe.AI_Score_99%
Fortinet	W32/Generic.A!tr
Ad-Aware	Gen:Variant.Zusy.289617
AVG	Win32:Trojan-gen
Cybereason	malicious.c4f392
Paloalto	generic.ml