Zusy.314723 (file analysis)

The Zusy.314723 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Zusy.314723 virus can do?

Creates RWX memory
At least one IP Address, Domain, or File Name was found in a crypto call
Drops a binary and executes it
Unconventionial language used in binary resources: Russian
The binary likely contains encrypted or compressed data.
Uses Windows utilities for basic functionality
Collects information about installed applications
Creates a hidden or system file
Checks the CPU name from registry, possibly for anti-virtualization
Harvests credentials from local FTP client softwares
Harvests information related to installed instant messenger clients
Makes SMTP requests, possibly sending spam or exfiltrating data.
Collects information to fingerprint the system
Anomalous binary characteristics

Related domains:

z.whorecord.xyz

a.tomx.xyz

smtp.mail.ru

How to determine Zusy.314723?


File Info:
crc32: B841EE0E
md5: 2570b35d8d41bc97eb7f00b1e9d5ee1a
name: 2570B35D8D41BC97EB7F00B1E9D5EE1A.mlw
sha1: 11080d7e67fbf9e24c0da3bca895fe8c2113352a
sha256: cf8df11bc96d6ca290aaf1b12b6fb05df40ec5831a677473c5034a5de4e70fc3
sha512: 871bbe91fbb9be172e69a1ae1252ade1d2965896e43bb6d3a89617c850fcbceababe16f6f1c3772d016854c5fc2f25d97f041f7d185ce1d0eceb0fd4559e509e
ssdeep: 24576:tn7vSqSSgC4s7wIDoF0tEOm7pZ8CirVByI7rhr761UYDOtSbWccE/KxmcK:tubkw3YEJZ8F5ByKuDDOIbWccE/Em
type: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows

Version Info:
0: [No Data]

Zusy.314723 also known as:

DrWeb	Trojan.DownLoader22.22548
MicroWorld-eScan	Gen:Variant.Zusy.314723
FireEye	Generic.mg.2570b35d8d41bc97
CAT-QuickHeal	TrojanSpy.MSIL
Qihoo-360	Generic/Trojan.Spy.b9c
ALYac	Gen:Variant.Zusy.314723
Cylance	Unsafe
Zillya	Trojan.Quasar.Win32.508
AegisLab	Hacktool.Win32.Agent.l2xv
Sangfor	Malware
K7AntiVirus	Trojan ( 0051a8931 )
BitDefender	Gen:Variant.Zusy.314723
K7GW	Trojan ( 0051a8931 )
Cybereason	malicious.d8d41b
BitDefenderTheta	AI:Packer.67BB8A0F1F
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Avast	Win32:Malware-gen
Kaspersky	Trojan-Spy.MSIL.Quasar.cjg
Alibaba	Trojan:Win32/Starter.ali2000005
NANO-Antivirus	Trojan.Win32.Quasar.euqetd
Rising	Trojan.Generic@ML.93 (RDMK:/Wv2KQdhn/SxT5vpBh+MBA)
Ad-Aware	Gen:Variant.Zusy.314723
Sophos	Mal/Generic-S
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TROJ_GEN.R002C0DAG21
McAfee-GW-Edition	BehavesLike.Win32.Generic.tc
Emsisoft	Gen:Variant.Zusy.314723 (B)
Jiangmin	Hoax.Agent.az
MAX	malware (ai score=99)
Antiy-AVL	Trojan/Win32.Reconyc
Kingsoft	Win32.Troj.Undef.(kcloud)
Microsoft	Backdoor:Win32/Xiclog.A
Arcabit	Trojan.Zusy.D4CD63
ZoneAlarm	Trojan-Spy.MSIL.Quasar.cjg
GData	Gen:Variant.Zusy.314723
AhnLab-V3	Spyware/Win32.Quasar.C4303803
McAfee	Artemis!2570B35D8D41
VBA32	BScope.TrojanPSW.UFR
Malwarebytes	Generic.Malware/Suspicious
Panda	Trj/CI.A
ESET-NOD32	a variant of Generik.HLLNGRN
TrendMicro-HouseCall	TROJ_GEN.R002C0DAG21
Tencent	Msil.Trojan-spy.Quasar.Hqlk
Yandex	Trojan.GenAsa!pY+NfUhPvC4
Ikarus	not-a-virus:Hoax.Win32.Agent
Fortinet	Generik.HLLNGRN!tr
AVG	Win32:Malware-gen
Paloalto	generic.ml

How to remove Zusy.314723?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Zusy.314723 (file analysis)