Zusy.325695 (B) malicious file

The Zusy.325695 (B) is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Zusy.325695 (B) virus can do?

Executable code extraction
Attempts to connect to a dead IP:Port (1 unique times)
Creates RWX memory
Reads data out of its own binary image
A process created a hidden window
Drops a binary and executes it
Unconventionial binary language: Russian
Unconventionial language used in binary resources: Russian
A scripting utility was executed
Uses Windows utilities for basic functionality
Anomalous binary characteristics

Related domains:

z.whorecord.xyz

a.tomx.xyz

dns2.soprodns.ru

How to determine Zusy.325695 (B)?


File Info:
crc32: B511276C
md5: b8792a4e413ffdd5be1493a365c16f28
name: B8792A4E413FFDD5BE1493A365C16F28.mlw
sha1: 160c995486efb9239e22ec0848072bcce4e1eb9b
sha256: 7c351bb113a82c9589845112630621d343befda408c028d364491352a6b4af1c
sha512: b4b0b30900d7485a95a3ee20b443ae32bf3cc5108b3c44e539a8ea7f4da5e7f1b7da936dfe307de32e825b0670097b7987ae6cd59ade6275e3a1c133476d3439
ssdeep: 3072:tZTz1WIXC6GESSgWNRXumi7+IF6foPCaTRMXbaev0FQcmWk6kwsNIf6cHzbQ2v0:tZHcIX9SSgMi+IFZMbQrkodzb4VF2Yd
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: Copyright (C) 2016
InternalName: audiohd.exe
FileVersion: 4.3.12.157
CompanyName: Microsoft inc.
ProductName: Windows Audio Driver
ProductVersion: 1.5.7.2
FileDescription: Windows Audio Driver
OriginalFilename: audiohd.exe
Translation: 0x0419 0x04b0

Zusy.325695 (B) also known as:

K7AntiVirus	Trojan ( 0051ebb51 )
Elastic	malicious (high confidence)
DrWeb	BackDoor.PsiXBot.2
Cynet	Malicious (score: 100)
ALYac	Gen:Variant.Zusy.325695
Cylance	Unsafe
Zillya	Backdoor.Agent.Win32.65204
K7GW	Trojan ( 0051ebb51 )
Cybereason	malicious.e413ff
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/Agent.BON
APEX	Malicious
Avast	Win32:Malware-gen
Kaspersky	HEUR:Trojan.Win32.Generic
BitDefender	Gen:Variant.Zusy.325695
MicroWorld-eScan	Gen:Variant.Zusy.325695
Tencent	Malware.Win32.Gencirc.1168ef3c
Ad-Aware	Gen:Variant.Zusy.325695
Sophos	Generic ML PUA (PUA)
BitDefenderTheta	Gen:NN.ZexaF.34266.su3@aOePXgnk
McAfee-GW-Edition	GenericRXEO-DN!B8792A4E413F
FireEye	Generic.mg.b8792a4e413ffdd5
Emsisoft	Gen:Variant.Zusy.325695 (B)
SentinelOne	Static AI – Suspicious PE
Jiangmin	Backdoor.MSIL.aqja
Avira	HEUR/AGEN.1116853
Antiy-AVL	Trojan/Generic.ASMalwS.24D71E2
Microsoft	Trojan:Win32/Wacatac.B!ml
GData	Gen:Variant.Zusy.325695
AhnLab-V3	Malware/Win32.Generic.C2459413
McAfee	GenericRXEO-DN!B8792A4E413F
MAX	malware (ai score=88)
VBA32	TScope.Trojan.MSIL
Malwarebytes	Malware.AI.2253289343
Panda	Trj/GdSda.A
Rising	Trojan.Generic@ML.87 (RDML:PY9Lr73XbVBzX4mIR7Faxw)
Yandex	Backdoor.Agent!HZGjF/MKXt0
Fortinet	W32/Generic.AC.41EDEB
AVG	Win32:Malware-gen

How to remove Zusy.325695 (B)?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Zusy.325695 (B) malicious file