Categories: Malware

About “Zusy.376884” infection

The Zusy.376884 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Zusy.376884 virus can do?

SetUnhandledExceptionFilter detected (possible anti-debug)
Behavioural detection: Executable code extraction – unpacking
Yara rule detections observed from a process memory dump/dropped files/CAPE
Creates RWX memory
Possible date expiration check, exits too soon after checking local time
Dynamic (imported) function loading detected
Enumerates running processes
Reads data out of its own binary image
CAPE extracted potentially suspicious content
Authenticode signature is invalid
Anomalous binary characteristics

How to determine Zusy.376884?


File Info:
name: 3D2C4A6BEAF68749EFE8.mlwpath: /opt/CAPEv2/storage/binaries/49dad481f04df934ca5f35b179b646e67d8006564429b71885d369843784384acrc32: 9414B69Amd5: 3d2c4a6beaf68749efe8503844997b10sha1: ca2cd1ec1e2434278c75054214ae13e4fa27f260sha256: 49dad481f04df934ca5f35b179b646e67d8006564429b71885d369843784384asha512: 0925741d0b188541bd74806d46324bc576815240a126089fd6d3e52015c4bbbd6ca151710418f6b7c345b9293f6a55f93458239d269b4f3aa3b6cb10e79515d2ssdeep: 12288:J2YgWapAcIcYU17Z4npoom2EadQQcNJ2BaSzPzAT/B1Gju:gYgRpA2YoSpoom2JdBO2rArBMtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T102D42987EB5C44D1F7EB83BF0E2C01E5E42F336399159FE69A04A262F1897674C98631sha3_384: 7619d6f5123ee1b1da8ba4ae1c4eb92b7c66028e8d18a77f1c873f59127ec4436f77cf0e2bb62ccc9313c1d8e75080b7ep_bytes: e8d5130000e989feffff8bff558bec8btimestamp: 1994-09-11 11:57:23
Version Info:
0: [No Data]

Zusy.376884 also known as:

Lionic	Trojan.Win32.Generic.4!c
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
FireEye	Generic.mg.3d2c4a6beaf68749
CAT-QuickHeal	Trojanspy.Zbot.16979
ALYac	Gen:Variant.Zusy.376884
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Riskware ( 0040eff71 )
Alibaba	TrojanSpy:Win32/Wonton.bc6868ef
K7GW	Riskware ( 0040eff71 )
Cybereason	malicious.beaf68
Baidu	Win32.Trojan-Downloader.Waski.a
VirIT	Trojan.Win32.Crypt3.NMJ
Cyren	W32/Zbot.SK.gen!Eldorado
Symantec	Trojan.Zbot
ESET-NOD32	Win32/Spy.Zbot.AAU
APEX	Malicious
Kaspersky	HEUR:Trojan.Win32.Generic
BitDefender	Gen:Variant.Zusy.376884
NANO-Antivirus	Trojan.Win32.Panda.cxiyzf
MicroWorld-eScan	Gen:Variant.Zusy.376884
Avast	Win32:Agent-AUID [Trj]
Tencent	Malware.Win32.Gencirc.10c481f1
Ad-Aware	Gen:Variant.Zusy.376884
Emsisoft	Gen:Variant.Zusy.376884 (B)
Comodo	TrojWare.Win32.Spy.Zbot.SJCB@5a4fmb
DrWeb	Trojan.PWS.Panda.7223
Zillya	Trojan.Zbot.Win32.157059
TrendMicro	TROJ_CRYPT.SMJ1
McAfee-GW-Edition	BehavesLike.Win32.PUPXBV.jh
Sophos	ML/PE-A + Troj/Wonton-CB
SentinelOne	Static AI – Malicious PE
GData	Win32.Trojan-Spy.Zbot.BH
Jiangmin	Trojan/Generic.bbecs
Webroot
Avira	TR/Spy.Zbot.rzoqon
MAX	malware (ai score=100)
Antiy-AVL	Trojan[Spy]/Win32.Zbot
Kingsoft	Win32.Troj.Undef.(kcloud)
Arcabit	Trojan.Zusy.D5C034
SUPERAntiSpyware	Trojan.Agent/Gen-Necurs
ZoneAlarm	HEUR:Trojan.Win32.Generic
Microsoft	PWS:Win32/Zbot
AhnLab-V3	Trojan/Win32.Zbot.C319341
Acronis	suspicious
McAfee	PWSZbot-FUO!3D2C4A6BEAF6
VBA32	TrojanSpy.Zbot
TrendMicro-HouseCall	TROJ_CRYPT.SMJ1
Rising	Spyware.Zbot!8.16B (CLOUD)
Yandex	Trojan.GenAsa!SkXFgZTCw1s
Ikarus	Trojan.Crypt3
eGambit	Generic.Malware
Fortinet	W32/Kryptik.AAU!tr
BitDefenderTheta	Gen:NN.ZexaF.34212.MuW@aa3bp4gi
AVG	Win32:Agent-AUID [Trj]
Panda	Trj/Genetic.gen
CrowdStrike	win/malicious_confidence_60% (D)