Zusy.322466 (file analysis)

The Zusy.322466 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Zusy.322466 virus can do?

Reads data out of its own binary image
Drops a binary and executes it
Authenticode signature is invalid
Attempts to create or modify system certificates
Yara detections observed in process dumps, payloads or dropped files

How to determine Zusy.322466?


File Info:
name: 76C315A6D01B048CA17E.mlw
path: /opt/CAPEv2/storage/binaries/db860e5f4bcec3411a7c45ea9148b2685644c26b44e92f4cd60629d3af0a960b
crc32: 870AB69B
md5: 76c315a6d01b048ca17e77bd19434210
sha1: 3031bda6d17bd9f994f5012239b5571ad9413da5
sha256: db860e5f4bcec3411a7c45ea9148b2685644c26b44e92f4cd60629d3af0a960b
sha512: a00bef5a2e303d3d8ba19fbf42cd734ddd08644e0724ae7f49d9e3e19ad216e88ab5c694a1693fc34ea4694b075ec26bb176bf8db920bea3a7367a45ac4630f6
ssdeep: 24576:FfR4X94KhxfQo1cbgjrkvz2M8JbaBS/04Nb88DtZDWXI+Wh+BuR:FfR4Xfhxb5UvyM8JGBS/04NzDO4dh+
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1EE064E5231E541AB8B3A32BC756F42A09E15381B135FBCA3B1E097B9D9F47BE4B94301
sha3_384: 614d204d93dbfc2e2a359c0eacc267a3ff2ed9921f16ad43e733d8a9fb9b24bfadb010d5172a2516ff403175db6e32f9
ep_bytes: e8f8640000e989feffff8bff558bec5d
timestamp: 2011-09-06 12:27:15

Version Info:
CompanyName: Solid State Networks
FileDescription: Adobe Flash Player Installer
FileVersion: 3.3.9.0
InternalName: host.exe
LegalCopyright: Copyright (C) Adobe Systems Incorporated
OriginalFilename: host.exe
ProductName: Adobe Flash Player Installer
ProductVersion: 3.3.9.0
Translation: 0x0409 0x04e4

Zusy.322466 also known as:

Bkav	W32.AIDetectMalware
AVG	Win32:Agent-AYZG [Cryp]
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Zusy.322466
FireEye	Generic.mg.76c315a6d01b048c
Skyhigh	BehavesLike.Win32.Generic.wh
McAfee	GenericR-KPW!76C315A6D01B
Malwarebytes	Wapomi.Virus.FileInfector.DDS
Zillya	Dropper.Agent.Win32.279169
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 0049c2301 )
K7GW	Trojan ( 0049c2301 )
CrowdStrike	win/malicious_confidence_100% (D)
BitDefenderTheta	Gen:NN.ZexaF.36802.Rx0@am8mJZdi
Symantec	ML.Attribute.HighConfidence
tehtris	Generic.Malware
ESET-NOD32	a variant of Win32/TrojanDropper.Agent.QQR
Cynet	Malicious (score: 100)
APEX	Malicious
ClamAV	Win.Malware.Ulise-9768992-0
Kaspersky	HEUR:Backdoor.Win32.Salgorea.gen
BitDefender	Gen:Variant.Zusy.322466
NANO-Antivirus	Trojan.Win32.Graftor.etoats
Avast	Win32:Agent-AYZG [Cryp]
Tencent	Trojan.Win32.Agent.xd
Emsisoft	Gen:Variant.Zusy.322466 (B)
Baidu	Win32.Trojan-Dropper.Agent.ab
F-Secure	Heuristic.HEUR/AGEN.1312668
DrWeb	Trojan.Siggen7.30988
VIPRE	Gen:Variant.Zusy.322466
Trapmine	malicious.high.ml.score
Sophos	Troj/Agent-BFWP
Ikarus	Trojan-Dropper.Agent
Jiangmin	Trojan.Generic.eeetn
Varist	W32/Zusy.BJ.gen!Eldorado
Avira	HEUR/AGEN.1312668
Antiy-AVL	Trojan[Backdoor]/Win32.Salgorea.gen
Kingsoft	malware.kb.a.999
Microsoft	Trojan:Win32/Salgorea.C!dha
Xcitium	Application.Win32.Amonetize.NE@5te978
Arcabit	Trojan.Zusy.D4EBA2
ZoneAlarm	HEUR:Backdoor.Win32.Salgorea.gen
GData	Win32.Trojan.PSE.17X2ZP9
Google	Detected
AhnLab-V3	Malware/Win32.RL_Generic.R358041
VBA32	BScope.TrojanDropper.Agent
ALYac	Gen:Variant.Zusy.322466
MAX	malware (ai score=85)
Cylance	unsafe
Panda	Trj/Genetic.gen
Rising	Backdoor.[OceanLotus]Salgorea!1.C3DC (CLASSIC)
Yandex	Trojan.Strictor!H4AlkDR60AA
SentinelOne	Static AI – Malicious PE
Fortinet	W32/Upatre.0285!tr
DeepInstinct	MALICIOUS
alibabacloud	Trojan[dropper]:Win/Agent.ebc84fd6

How to remove Zusy.322466?

Zusy.322466 removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X