Categories: Malware

About “Zusy.320612” infection

The Zusy.320612 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Zusy.320612 virus can do?

Behavioural detection: Executable code extraction – unpacking
Yara rule detections observed from a process memory dump/dropped files/CAPE
Performs HTTP requests potentially not found in PCAP.
CAPE extracted potentially suspicious content
Unconventionial binary language: Chinese (Simplified)
Authenticode signature is invalid
Behavioural detection: Transacted Hollowing

How to determine Zusy.320612?


File Info:
name: 23273A83BFD7AED10B94.mlwpath: /opt/CAPEv2/storage/binaries/f6c62f9f846b3d100d60b1f2ae57a71c91dd8dc215dce652e2c85dff60c0197fcrc32: 5CF56F78md5: 23273a83bfd7aed10b9403e23a8bcba9sha1: 78d1c1e11ebae22849bccb3eb154ec986d992364sha256: f6c62f9f846b3d100d60b1f2ae57a71c91dd8dc215dce652e2c85dff60c0197fsha512: 279f1e6887adccb2d679736354b5df51c78e7308c05b47ae2dba66ec7d73e46ace8aa6ec33a2001cce7f6a20870ea3ea6acf4f49ca8f137aa11dddb26487ce90ssdeep: 6144:/gLKYYoeCQEgGS0t1lem1qXAva/BeIHhAMMwXS:4rZeJEg+lHi9BeIHhAMMwXStype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T15F54AE1075C5C673F06306FC49B593B28E26FC618B31969F77E82FEE4E285C2A95431Asha3_384: aea56e6cc1dfc9092a41ece3b96c8d5d6dcbab5f9f01701defe48b29bed87900b0b821d84c24ef7cef6dabd4b3fa5102ep_bytes: e8b6560000e995feffffff35dca76100timestamp: 2015-02-27 14:29:51
Version Info:
CompanyName: Symantec CorporationLegalCopyright: Copyright© 1998-2008 Symantec Corporation, All rights reserved.LegalTrademarks: Symantec?¡¢Symantec »Õ±ê¡¢Symantec Backup Exec? ºÍ Symantec NetBackup? ÊÇ Symantec Corporation µÄÉÌ±ê»ò×¢²áÉÌ±ê¡£FileDescription: Symantec DLO Desktop AgentFileVersion: 3.10.346.0601OriginalFilename: ClientUI.exeProductName: Desktop and Laptop OptionProductVersion: 3.01.00.0000BuildNumber: 3.46.06aTranslation: 0x0804 0x04b0

Zusy.320612 also known as:

MicroWorld-eScan	Gen:Variant.Zusy.320612
FireEye	Generic.mg.23273a83bfd7aed1
McAfee	GenericR-EJA!23273A83BFD7
Cylance	Unsafe
VIPRE	Gen:Variant.Zusy.320612
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Password-Stealer ( 0055e3dc1 )
Alibaba	TrojanPSW:Win32/CakeDuke.b970e029
K7GW	Password-Stealer ( 0055e3dc1 )
Cybereason	malicious.3bfd7a
VirIT	Trojan.Win32.Dnldr13.CFFM
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	Win32/PSW.Agent.OAI
APEX	Malicious
Paloalto	generic.ml
Kaspersky	Trojan.Win32.CakeDuke.a
BitDefender	Gen:Variant.Zusy.320612
NANO-Antivirus	Trojan.Win32.Agent.dqzsao
Avast	Win32:Malware-gen
Tencent	Win32.Trojan.Cakeduke.Hnut
Ad-Aware	Gen:Variant.Zusy.320612
Sophos	Troj/Agent-AMVH
Comodo	Malware@#3rgj9c35eo4j8
DrWeb	Trojan.DownLoader13.38674
Zillya	Trojan.Agent.Win32.528469
TrendMicro	BKDR_COSMICDUKE.A
McAfee-GW-Edition	BehavesLike.Win32.PWSZbot.dh
Trapmine	malicious.high.ml.score
Emsisoft	Gen:Variant.Zusy.320612 (B)
SentinelOne	Static AI – Malicious PE
GData	Gen:Variant.Zusy.320612
Jiangmin	Trojan.CakeDuke.b
Webroot	W32.Trojan.Gen
Google	Detected
Avira	HEUR/AGEN.1224191
Antiy-AVL	Trojan/Generic.ASMalwS.4694
Microsoft	Trojan:Win32/Skeeyah.A!rfn
Cynet	Malicious (score: 100)
AhnLab-V3	Backdoor/Win32.Tinybaron.C859638
BitDefenderTheta	Gen:NN.ZexaF.34592.rq0@a8lOl4ji
ALYac	Gen:Variant.Zusy.320612
MAX	malware (ai score=100)
TrendMicro-HouseCall	BKDR_COSMICDUKE.A
Rising	Trojan.Generic@AI.100 (RDML:NZrvwJHOlMX4djHJfxtU+g)
Yandex	Trojan.PWS.Agent!4DCE+65NukE
Ikarus	Trojan.Win32.PSW
Fortinet	W32/Agent.OAI!tr.pws
AVG	Win32:Malware-gen
Panda	Generic Suspicious
CrowdStrike	win/malicious_confidence_100% (W)