Malware

Zusy.317025 removal tips

Malware Removal

The Zusy.317025 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Zusy.317025 virus can do?

  • SetUnhandledExceptionFilter detected (possible anti-debug)
  • Yara rule detections observed from a process memory dump/dropped files/CAPE
  • Dynamic (imported) function loading detected
  • At least one IP Address, Domain, or File Name was found in a crypto call
  • Starts servers listening on 127.0.0.1:0
  • Reads data out of its own binary image
  • A process created a hidden window
  • Drops a binary and executes it
  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid
  • Uses Windows utilities for basic functionality
  • Deletes its original binary from disk
  • Created a process from a suspicious location
  • Harvests cookies for information gathering
  • Attempts to create or modify system certificates

How to determine Zusy.317025?



File Info:

name: EC6623A87DE6D6B1C5C5.mlw
path: /opt/CAPEv2/storage/binaries/7bb8c9937543fc8be65f79a471fba343a21d19701a5a7772773af86e71c12424
crc32: 548A93E2
md5: ec6623a87de6d6b1c5c5eab98cad9dc8
sha1: b03451558843c157b6c0b43784b42673be262336
sha256: 7bb8c9937543fc8be65f79a471fba343a21d19701a5a7772773af86e71c12424
sha512: 56ab86a18e79ab1e55ad34e2354431acef818efda3a4f4c5613b5be2ea768643cb99f3dbad8a0813db21708c26b51194154f1ccf5a748da4846ee7ba2d9695d2
ssdeep: 49152:SYp95kv1PANLUcjcvhCcD0Tgy0LXu1qoTzmYvr6/T7:Rp9ivu1UEcvkcD+v49pN/3
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1CED522EC51E15219BC42211A2AD7FAE009F1EB563BBE38E3DFC32594953B19ADE1C305
sha3_384: a9b5ba5aa9be033899cd0c47c2bfbbd854d6a2a8cc829c9a082aba152a1b184eeff17533c7e84bd2f6dcc18c8e54131c
ep_bytes: e839330000e989feffff8bff558bec5d
timestamp: 2006-10-19 18:35:31


Version Info:

CompanyName: Adobe
FileDescription: Adobe Installation Helper
FileVersion: 3.5.4.24
InternalName: host.exe
LegalCopyright: Copyright © Adobe Systems Incorporated
OriginalFilename: host.exe
ProductName: Adobe Installation Helper
ProductVersion: 2.0.2.4
Translation: 0x0409 0x04e4

Zusy.317025 also known as:

BkavW32.AIDetect.malware1
LionicTrojan.Win32.Zusy.4!c
Elasticmalicious (high confidence)
DrWebTrojan.Siggen6.27065
MicroWorld-eScanGen:Variant.Zusy.317025
FireEyeGeneric.mg.ec6623a87de6d6b1
CAT-QuickHealTrojan.Cuegoe.18812
McAfeeGenericRXNJ-UX!EC6623A87DE6
CylanceUnsafe
ZillyaDropper.Agent.Win32.178024
SangforTrojan.Win32.Save.a
CrowdStrikewin/malicious_confidence_100% (W)
AlibabaTrojan:Win32/Salgorea.379
K7GWTrojan ( 005720591 )
K7AntiVirusTrojan ( 005720591 )
BitDefenderThetaGen:NN.ZexaF.34294.Ps0@aeevxdoi
CyrenW32/Agent.CWN.gen!Eldorado
SymantecML.Attribute.HighConfidence
ESET-NOD32a variant of Win32/TrojanDropper.Agent.QWT
APEXMalicious
Paloaltogeneric.ml
ClamAVWin.Malware.Bskd-9753126-0
KasperskyTrojan.Win32.Agentb.jqrl
BitDefenderGen:Variant.Zusy.317025
NANO-AntivirusTrojan.Win32.TrjGen.dlaxzt
AvastWin32:Agent-AYZG [Cryp]
TencentTrojan.Win32.BitCoinMiner.la
Ad-AwareGen:Variant.Zusy.317025
TACHYONTrojan/W32.Agent.2771968.J
SophosML/PE-A + Troj/Agent-BHCG
ComodoTrojWare.Win32.Agent.QGO@57p1tw
VIPRETrojan.Win32.Orbus (fs)
TrendMicroTROJ_GEN.R002C0DKQ21
McAfee-GW-EditionBehavesLike.Win32.Generic.vc
EmsisoftGen:Variant.Zusy.317025 (B)
IkarusTrojan.Win32.Salgorea
GDataGen:Variant.Zusy.317025
JiangminTrojan.Generic.gvsok
AviraHEUR/AGEN.1117297
Antiy-AVLTrojan/Win32.AGeneric
MicrosoftTrojan:Win32/Salgorea.C!dha
CynetMalicious (score: 100)
AhnLab-V3Dropper/Win.Agent.R418672
Acronissuspicious
ALYacGen:Variant.Zusy.317025
MAXmalware (ai score=80)
VBA32BScope.Trojan.Salgorea
MalwarebytesMalware.AI.4265287508
TrendMicro-HouseCallTROJ_GEN.R002C0DKQ21
RisingBackdoor.[OceanLotus]Salgorea!1.C3DC (CLASSIC)
YandexTrojan.Agentb!fyn/nQJocmk
SentinelOneStatic AI – Malicious PE
eGambitUnsafe.AI_Score_99%
FortinetW32/Agent.QUM!tr
AVGWin32:Agent-AYZG [Cryp]
Cybereasonmalicious.87de6d
PandaTrj/Genetic.gen
MaxSecureTrojan.Malware.7164915.susgen

How to remove Zusy.317025?

Zusy.317025 removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment