Malware

Should I remove “Zusy.304785”?

Malware Removal

The Zusy.304785 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Zusy.304785 virus can do?

  • Yara rule detections observed from a process memory dump/dropped files/CAPE
  • Creates RWX memory
  • Dynamic (imported) function loading detected
  • Reads data out of its own binary image
  • Unconventionial language used in binary resources: Chinese (Simplified)
  • The binary contains an unknown PE section name indicative of packing
  • Authenticode signature is invalid
  • Anomalous binary characteristics

How to determine Zusy.304785?



File Info:

name: A75F84269D0C62C97E9A.mlw
path: /opt/CAPEv2/storage/binaries/5370ef98f707d2a80249a8e6acb71bb920cf96eb65f0724a35f72827e41b4617
crc32: 38E3E332
md5: a75f84269d0c62c97e9a0aed4fca2bcb
sha1: 3a45243425caf0c5cd0afaaed498099ad00e54e4
sha256: 5370ef98f707d2a80249a8e6acb71bb920cf96eb65f0724a35f72827e41b4617
sha512: ca59e44464aa1d4e8f17a4dcfd0cd9f7930990cdf0c858a1206da2857d876eb5dfd6c9d7fcb073e9b67f2bf6f3b5c9a5c481fb9ab9e4e55cba67a2b1bdffc48e
ssdeep: 196608:GxIth8V2KQqGfyxXIicOExzUx8Bssun3f6B2+EiSJwNg1Vssqa2mYDPHpdT2jEPG:Dh8V2KQH6uBsc9Ei2wNg1Vssqa2meYjl
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T105B6AE92B6828033C0A7D6345C4FA3F56129BB311F3856CB77E19E8C5E753D16A342AB
sha3_384: eeca86fc681cb608027559d744c3710c6bace0eeda3e408e4868466db466582d8b159ebef4b27a2dedd1f866fae3acfd
ep_bytes: 558bec83c4f0b8ac935500e86cd9eaff
timestamp: 1992-06-19 22:22:17


Version Info:

0: [No Data]

Zusy.304785 also known as:

LionicRiskware.Win32.Zusy.1!c
Elasticmalicious (high confidence)
MicroWorld-eScanGen:Variant.Zusy.304785
FireEyeGeneric.mg.a75f84269d0c62c9
ALYacGen:Variant.Zusy.304785
CylanceUnsafe
SangforVirus.Win32.Save.a
K7AntiVirusRiskware ( 0040eff71 )
AlibabaRiskWare:Win32/EncPK.c46df947
K7GWRiskware ( 0040eff71 )
Cybereasonmalicious.69d0c6
ArcabitTrojan.Zusy.D4A691
SymantecML.Attribute.HighConfidence
ESET-NOD32a variant of Win32/RiskWare.GameTool.O
TrendMicro-HouseCallTROJ_GEN.R002C0RB622
Paloaltogeneric.ml
BitDefenderGen:Variant.Zusy.304785
AvastWin32:MiscX-gen [PUP]
Ad-AwareGen:Variant.Zusy.304785
SophosMal/Generic-R
TrendMicroTROJ_GEN.R002C0RB622
McAfee-GW-EditionBehavesLike.Win32.Dropper.vh
EmsisoftGen:Variant.Zusy.304785 (B)
AviraHEUR/AGEN.1219890
MAXmalware (ai score=80)
Antiy-AVLTrojan/Generic.ASMalwS.313D49D
GridinsoftRansom.Win32.Sabsik.sa
MicrosoftTrojan:Win32/Sabsik.FL.B!ml
GDataGen:Variant.Zusy.304785
CynetMalicious (score: 99)
AhnLab-V3Malware/Gen.RL_Reputation.R359106
McAfeeArtemis!A75F84269D0C
VBA32BScope.Trojan.Diple
APEXMalicious
YandexRiskWare.GameTool!oA8dL465Qz8
SentinelOneStatic AI – Suspicious PE
FortinetRiskware/GameTool
AVGWin32:MiscX-gen [PUP]
MaxSecureTrojan.Malware.300983.susgen

How to remove Zusy.304785?

Zusy.304785 removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment