Malware

Zusy.376265 malicious file

Malware Removal

The Zusy.376265 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Zusy.376265 virus can do?

  • SetUnhandledExceptionFilter detected (possible anti-debug)
  • Creates RWX memory
  • Dynamic (imported) function loading detected
  • Unconventionial binary language: Chinese (Simplified)
  • Unconventionial language used in binary resources: Chinese (Simplified)
  • Authenticode signature is invalid

How to determine Zusy.376265?



File Info:

name: 671AEBE909A7BD8FC6CF.mlw
path: /opt/CAPEv2/storage/binaries/2af731a3ad67761c127174cde5fc8b8f0c025caa54a436aaa17467c7b510442e
crc32: 5E695B2C
md5: 671aebe909a7bd8fc6cf9276849cb409
sha1: 1cf2ff63187daca27a190c03807fff9334e0f3be
sha256: 2af731a3ad67761c127174cde5fc8b8f0c025caa54a436aaa17467c7b510442e
sha512: 13ea719723473e537436504174ecc2260a220b1a08326c66b1381908980a81f1574a1cca7305a684fba881c996b880563c86d04bd726d94870dd24443a21808e
ssdeep: 49152:ceDSeTL4PDLAnO3MY2P/ys8LKs4Lz+3bYH3VnJyMHc+vEkwh5Cg5gRmep89:D/TLoAOcH/ynm+3kXVnJVc2whggmRB89
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1B9466C237420D454D8400B3FE692463864A71658E8FAD443FB4CBE67BB396136A6FB1F
sha3_384: 8bea42e1cf28f075a67abf5248d2f4ad7aa6f166ab2fe42e33ffc123a2cbe039a6af0325de0a2b8a1ff059504b9d4b1b
ep_bytes: 558bec6aff68104f770068ecfc690064
timestamp: 2018-12-26 10:21:22


Version Info:

Comments: 本程序由papercut开发,任何人不得用于木马,病毒,后门等用途!由此造成一切后果,本人不负任何及连带责任!
CompanyName: 乐赏GSCQ|GBT小组出品
FileDescription: 百战天虫WMD——————集成Brimstone升级档中英文完整硬盘版
FileVersion: 集成Brimstone升级档
InternalName: Setup.exe
LegalCopyright: 版权所有 乐赏 1998-2022
LegalTrademarks: China.tianchao
OriginalFilename: Setup.exe
PrivateBuild: ‘  WORLD ORDER
ProductName: 百战天虫WMD——————集成Brimstone升级档中英文完整硬盘版
ProductVersion: 集成Brimstone升级档
SpecialBuild: 集成Brimstone升级档
Translation: 0x0804 0x04b0

Zusy.376265 also known as:

Elasticmalicious (high confidence)
MicroWorld-eScanGen:Variant.Zusy.376265
FireEyeGeneric.mg.671aebe909a7bd8f
McAfeeArtemis!671AEBE909A7
CylanceUnsafe
ZillyaTrojan.Convagent.Win32.250
SangforTrojan.Win32.Bsymem.gen
K7AntiVirusTrojan ( 005246d51 )
AlibabaTrojan:Win32/BlackMoon.24ad0b34
K7GWTrojan ( 005246d51 )
CrowdStrikewin/malicious_confidence_100% (W)
CyrenW32/Trojan.CLL.gen!Eldorado
SymantecML.Attribute.HighConfidence
ESET-NOD32a variant of Win32/Packed.BlackMoon.A potentially unwanted
APEXMalicious
Paloaltogeneric.ml
ClamAVWin.Malware.Zusy-9865501-0
KasperskyHEUR:Trojan.Win32.Bsymem.gen
BitDefenderGen:Variant.Zusy.376265
AvastWin32:Malware-gen
SophosMal/Generic-S
ComodoWorm.Win32.Dropper.RA@1qraug
TrendMicroTROJ_GEN.R002C0DAU22
McAfee-GW-EditionBehavesLike.Win32.Virus.tc
EmsisoftGen:Variant.Zusy.376265 (B)
SentinelOneStatic AI – Malicious PE
JiangminTrojan.Bsymem.agm
Antiy-AVLTrojan/Generic.ASCommon.FA
KingsoftWin32.Troj.Generic_a.a.(kcloud)
MicrosoftVirTool:Win32/AutoRun!atmn
GDataGen:Variant.Zusy.376265
CynetMalicious (score: 100)
BitDefenderThetaGen:NN.ZexaF.34182.@t3@aWslPVob
ALYacGen:Variant.Zusy.376265
MAXmalware (ai score=83)
VBA32BScope.Trojan.Tiggre
MalwarebytesTrojan.MalPack.FlyStudio
TrendMicro-HouseCallTROJ_GEN.R002C0DAU22
RisingTrojan.Kryptik!1.B3E8 (CLOUD)
YandexTrojan.GenAsa!OhxoQ9Aj8SA
IkarusTrojan-Downloader
FortinetW32/CoinMiner.65CA!tr
AVGWin32:Malware-gen
Cybereasonmalicious.909a7b
PandaTrj/CI.A

How to remove Zusy.376265?

Zusy.376265 removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment