Categories: Malware

What is “Zusy.348943”?

The Zusy.348943 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Zusy.348943 virus can do?

Injection (inter-process)
Injection with CreateRemoteThread in a remote process
Attempts to connect to a dead IP:Port (2 unique times)
Creates RWX memory
Loads a driver
Repeatedly searches for a not-found process, may want to run with startbrowser=1 option
A process created a hidden window
Performs some HTTP requests
Uses Windows utilities for basic functionality
Code injection with CreateRemoteThread in a remote process
Attempts to stop active services
A process attempted to delay the analysis task by a long amount of time.
Installs itself for autorun at Windows startup
Attempts to modify proxy settings
Creates a copy of itself
Anomalous binary characteristics

Related domains:

z.whorecord.xyz

a.tomx.xyz

tre05.u2h6n.com

How to determine Zusy.348943?


File Info:
crc32: EA86AEE1md5: 80e4b1cdfb7fcffa2167cf9b7bda314dname: 80E4B1CDFB7FCFFA2167CF9B7BDA314D.mlwsha1: b4f4605143480461b335ed5b04b154a4abece939sha256: 6698ba6c0c92056ddae1142fffb58225c245bea4af3272432696b666604365a2sha512: 0b87818d64829045b895bde85ae66b3168aba27749c9141e9debb46bbf51791258325dcba9da61c1d4d2b442875292f6af02f9d0a7ff9f23211d1efcbe374fc0ssdeep: 3072:1PS0tBsIg97iFz7OF+6aLK2IJqi6uS+gkDstXKJVNnxGgpqZctQBIpQ4PC16Qd0a:9lg97jJVNnCcfQ4C1Peatype: PE32 executable (GUI) Intel 80386, for MS Windows
Version Info:
0: [No Data]

Zusy.348943 also known as:

Bkav	W32.AIDetectVM.malware1
Elastic	malicious (high confidence)
DrWeb	Trojan.BrowseBan.565
MicroWorld-eScan	Gen:Variant.Zusy.348943
FireEye	Generic.mg.80e4b1cdfb7fcffa
CAT-QuickHeal	TrojanDownloader.Small.BPQ4
ALYac	Gen:Variant.Zusy.348943
Cylance	Unsafe
VIPRE	TrojanDownloader.Win32.Geral.a (v)
Sangfor	Malware
K7AntiVirus	Trojan ( 0015650d1 )
BitDefender	Gen:Variant.Zusy.348943
K7GW	Trojan ( 0015650d1 )
Cybereason	malicious.dfb7fc
BitDefenderTheta	AI:Packer.BC716C5C1E
Cyren	W32/KillAV.AI.gen!Eldorado
Symantec	W32.SillyDC
ESET-NOD32	a variant of Win32/AntiAV.NFM
APEX	Malicious
ClamAV	Win.Trojan.KillAV-47
Kaspersky	HEUR:Trojan.Win32.Generic
NANO-Antivirus	Trojan.Win32.Scar.cskry
ViRobot	Trojan.Win32.A.Agent.145920.N
Tencent	Malware.Win32.Gencirc.10b3e360
Ad-Aware	Gen:Variant.Zusy.348943
Sophos	ML/PE-A
Comodo	TrojWare.Win32.PSW.GamePass.B@2mkvnt
F-Secure	Worm.WORM/Citeary.655484
Baidu	Win32.Backdoor.Agent.n
Zillya	Trojan.Scar.Win32.46238
TrendMicro	TROJ_SPNR.05CN14
McAfee-GW-Edition	BehavesLike.Win32.Backdoor.ch
Emsisoft	Gen:Variant.Zusy.348943 (B)
Ikarus	Worm.Win32.Citeary
Jiangmin	Trojan/Generic.bhbq
Avira	WORM/Citeary.655484
MAX	malware (ai score=82)
Microsoft	Worm:Win32/Citeary.E
Arcabit	Trojan.Zusy.D5530F
ZoneAlarm	HEUR:Trojan.Win32.Generic
GData	Gen:Variant.Zusy.348943
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Scar.C99295
Acronis	suspicious
McAfee	GenericRXFW-PQ!80E4B1CDFB7F
VBA32	BScope.Trojan.BrowseBan
Malwarebytes	Trojan.KillAV
Panda	Trj/Genetic.gen
TrendMicro-HouseCall	TROJ_SPNR.05CN14
Rising	Worm.Citeary!1.9EC8 (RDMK:cmRtazqu5a790hSLJKVyCR3hMWlX)
Yandex	Trojan.GenAsa!zeqCoP+eQ3k
SentinelOne	Static AI – Malicious PE – Downloader
eGambit	Unsafe.AI_Score_88%
Fortinet	W32/AntiAV.NFM!tr
AVG	Win32:Geral [Trj]
Avast	Win32:Geral [Trj]
CrowdStrike	win/malicious_confidence_100% (D)
Qihoo-360	HEUR/QVM10.1.0C47.Malware.Gen