Categories: Malware

About “Zusy.373066” infection

The Zusy.373066 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Zusy.373066 virus can do?

SetUnhandledExceptionFilter detected (possible anti-debug)
Yara rule detections observed from a process memory dump/dropped files/CAPE
Presents an Authenticode digital signature
Dynamic (imported) function loading detected
Reads data out of its own binary image
A process created a hidden window
Authenticode signature is invalid
A ping command was executed with the -n argument possibly to delay analysis
Uses Windows utilities for basic functionality
Created a process from a suspicious location
Detects the presence of Windows Defender AV emulator via files
Anomalous binary characteristics

How to determine Zusy.373066?


File Info:
name: 6A16E2576B98DF9F5F53.mlwpath: /opt/CAPEv2/storage/binaries/186f16553a6309ae7e76a4eb12e15142f493ea6f4cb79357219ae9df6368016acrc32: F6A6C40Cmd5: 6a16e2576b98df9f5f53c399054b6d52sha1: 00803be8e4f35f4f4a3e3ff44470d523094125f7sha256: 186f16553a6309ae7e76a4eb12e15142f493ea6f4cb79357219ae9df6368016asha512: f8a1fbae069f04a47c4aa3f3e0a7ca0fa196ad21587244c51a3de2601d0141d4f781c314beedd72caa60af2c1c9220cbfbbbca64b4a515da0782312f14d22980ssdeep: 24576:L53uhF890BmJOPAmYfeE11OFfMhRzU4gemCDphtWUsjpPHJEkYEYN/pO/lKr/j7:L5+hF6mYfAkRgdemUntWFPHJEkIpONCtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1B49523232B9E30F1CAD326B13859371721B5A2738F71C4C75BF123AEA9648C6D578279sha3_384: 437420850377eb1eee87c55202d589b44e9f12d842d594e73e1a1a6fc07ad49336a9523280b972a8c8de6ac88505bfe5ep_bytes: 558bec6aff6880fa410068f0c4410064timestamp: 2016-04-02 22:14:34
Version Info:
CompanyName: Oleg N. ScherbakovFileDescription: 7z Setup SFX (x86)FileVersion: 1.7.0.3900InternalName: 7ZSfxModLegalCopyright: Copyright © 2005-2016 Oleg N. ScherbakovOriginalFilename: 7ZSfxMod_x86.exePrivateBuild: April 1, 2016ProductName: 7-Zip SFXProductVersion: 1.7.0.3900Translation: 0x0000 0x04b0

Zusy.373066 also known as:

Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Zusy.373066
FireEye	Generic.mg.6a16e2576b98df9f
ALYac	Gen:Variant.Zusy.373066
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 005798ba1 )
Alibaba	Trojan:Win32/Crypzip.7a480b51
K7GW	Trojan ( 005798ba1 )
Cybereason	malicious.76b98d
Cyren	W32/Trojan.CDLU-7259
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Packed.7Zip.S.gen
TrendMicro-HouseCall	Trojan.Win32.CRYPZIP.SMRAH
Paloalto	generic.ml
ClamAV	Win.Malware.Zusy-9847818-0
Kaspersky	UDS:DangerousObject.Multi.Generic
BitDefender	Gen:Variant.Zusy.373066
Avast	Win32:7Drop-D [Trj]
Ad-Aware	Gen:Variant.Zusy.373066
Sophos	Mal/Generic-R + Troj/Agent-BGQN
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	Trojan.Win32.CRYPZIP.SMRAH
McAfee-GW-Edition	Artemis!Trojan
Emsisoft	Gen:Variant.Zusy.373066 (B)
GData	Gen:Variant.Zusy.373066
Jiangmin	Trojan/CoinMiner.ab.a
Webroot	Pua.Opencandy
Avira	TR/Patched.Gen
Arcabit	Trojan.Zusy.D5B14A
Microsoft	VirTool:Win32/AutInject.CP
Cynet	Malicious (score: 100)
McAfee	Artemis!6A16E2576B98
MAX	malware (ai score=85)
VBA32	Trojan.Hesv
Malwarebytes	Trojan.Dropper.Generic
Rising	Trojan.HiddenRun/SFX!1.D57B (CLASSIC)
Yandex	Trojan.Crypzip!0G6sd/U0w0Q
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.115685787.susgen
Fortinet	PossibleThreat.PALLAS.H
AVG	Win32:7Drop-D [Trj]
Panda	Trj/CI.A