About "Zusy.306993 (B)" infection

The Zusy.306993 (B) is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Zusy.306993 (B) virus can do?

Executable code extraction
Creates RWX memory
Reads data out of its own binary image
The binary likely contains encrypted or compressed data.
Attempts to repeatedly call a single API many times in order to delay analysis time
Unusual version info supplied for binary

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine Zusy.306993 (B)?


File Info:
crc32: 2FFA4665
md5: 53ac59d365d8aa5a971f18f3ea4b31a7
name: 209a01938abgs.exe
sha1: efab999f879fbbb3a92c9013a3bc54b5c4259f9f
sha256: ee4618f53c73776a3d39ae2301e411d6ab8b92beaca89f6abeead517045eba5d
sha512: 6e64db158a09a3e764ec2e66283d389e0da46f2e2275f2c395806c46ace8e8726f2ad679ff712e5b931181672c1d5e7af5802f8c25bb3ebc0f7e1d9d519f02ac
ssdeep: 6144:gIWQeCCxoCa4EzEuP3K95X0H2kOU3vkjD8m3BZbyqP2X/r:gIWQsoCaJr/Kjo8jD8EP2j
type: PE32 executable (console) Intel 80386, for MS Windows

Version Info:
LegalCopyright: xa9 Microsoft Corporation. All rights reserved.
InternalName: BthCxn.exe
FileVersion: 6.0.6000.16384
CompanyName: Windows (R) Codename Longhorn DDK provider
ProductName: Windows (R) Codename Longhorn DDK driver
ProductVersion: 6.0.6000.16384
FileDescription: Bluetooth Connection Sample Application
OriginalFilename: BthCxn.exe
Translation: 0x0409 0x04b0

Zusy.306993 (B) also known as:

Bkav	W32.AIDetectVM.malwareB
FireEye	Generic.mg.53ac59d365d8aa5a
ALYac	Gen:Variant.Mikey.113712
Malwarebytes	Trojan.TrickBot
AegisLab	Trojan.Win32.Malicious.4!c
Sangfor	Malware
K7AntiVirus	Riskware ( 0040eff71 )
BitDefender	Gen:Variant.Zusy.306993
K7GW	Riskware ( 0040eff71 )
Cybereason	malicious.f879fb
Arcabit	Trojan.Zusy.D4AF31
Invincea	heuristic
BitDefenderTheta	Gen:NN.ZexaF.34128.uu1@aGTj4nai
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	Win32/TrickBot.CR
APEX	Malicious
Paloalto	generic.ml
Cynet	Malicious (score: 100)
Kaspersky	UDS:DangerousObject.Multi.Generic
Alibaba	Trojan:Application/TrickBot.91d48ce4
MicroWorld-eScan	Gen:Variant.Zusy.306993
Tencent	Malware.Win32.Gencirc.119893b9
Ad-Aware	Gen:Variant.Zusy.306993
Emsisoft	Gen:Variant.Zusy.306993 (B)
F-Secure	Trojan.TR/AD.TrickBot.pjhaw
DrWeb	Trojan.Packed.140
TrendMicro	Mal_Cerber-23
McAfee-GW-Edition	Artemis!Trojan
Trapmine	suspicious.low.ml.score
Sophos	Mal/Generic-S
Ikarus	Win32.Outbreak
Avira	TR/AD.TrickBot.pjhaw
Fortinet	W32/Trickbot.HEEV!tr
Antiy-AVL	Trojan/Win32.Wacatac
Endgame	malicious (high confidence)
Microsoft	Trojan:Win32/TrickBot.ARJ!MTB
ZoneAlarm	UDS:DangerousObject.Multi.Generic
AhnLab-V3	Trojan/Win32.Trickbot.R340882
McAfee	GenericRXAA-AA!53AC59D365D8
MAX	malware (ai score=81)
Cylance	Unsafe
TrendMicro-HouseCall	Mal_Cerber-23
Rising	Malware.Undefined!8.C (CLOUD)
SentinelOne	DFI – Malicious PE
GData	Gen:Variant.Zusy.306993
AVG	Win32:Malware-gen
Avast	Win32:Malware-gen
CrowdStrike	win/malicious_confidence_100% (W)

How to remove Zusy.306993 (B)?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About “Zusy.306993 (B)” infection