What is "Zusy.378774"? – Adware Reports

The Zusy.378774 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Zusy.378774 virus can do?

At least one process apparently crashed during execution
Attempts to connect to a dead IP:Port (1 unique times)
Creates RWX memory
A process attempted to delay the analysis task.
Repeatedly searches for a not-found process, may want to run with startbrowser=1 option
A process created a hidden window
Drops a binary and executes it
Creates an autorun.inf file
Attempts to repeatedly call a single API many times in order to delay analysis time
Installs itself for autorun at Windows startup
Creates a hidden or system file
Creates a copy of itself
Attempts to disable UAC
Attempts to modify UAC prompt behavior

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine Zusy.378774?


File Info:
crc32: 69D41D7E
md5: a2cb612332632d5158c3c7c7cece8a28
name: A2CB612332632D5158C3C7C7CECE8A28.mlw
sha1: 9d1e5c8b037ac70ba1c611225e1985a4aeba9a1b
sha256: f7895214503b4888e4da809ac6869929bd33df0776177f10e4416e0879fd0672
sha512: ef43adb960cd5498d85e1fbeb92b6f42d2cd91910cac8e5d2b95c9ed6cee9c733b6f8f8173e0f53cd9dc1e370b3104b463f9c78c5529f42e5dc5ef399d42203a
ssdeep: 24576:7xl/L4U7IrLBms4o2S3ge8ZuuTCxrblAWEn1snN:37IrLBmQ2SQsuTCFxAWEn1snN
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: xa9 Microsoft Corporation. All rights reserved.
InternalName: taskhost.exe
FileVersion: 10.0.17763.831 (WinBuild.160101.0800)
CompanyName: Microsoft Corporation
ProductName: Microsoftxae Windowsxae Operating System
ProductVersion: 10.0.17763.831
FileDescription: Host Process for Windows Tasks
OriginalFilename: taskhost.exe
Translation: 0x0409 0x04b0

Zusy.378774 also known as:

K7AntiVirus	Trojan ( 00577dec1 )
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
ALYac	Gen:Variant.Zusy.378774
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_60% (D)
K7GW	Trojan ( 00577dec1 )
Cybereason	malicious.332632
Symantec	Ransom.Avaddon!g1
ESET-NOD32	a variant of Win32/Filecoder.Avaddon.D
APEX	Malicious
Avast	Win32:Trojan-gen
Kaspersky	HEUR:Trojan.Win32.DelShad.gen
BitDefender	Gen:Variant.Zusy.378774
MicroWorld-eScan	Gen:Variant.Zusy.378774
Ad-Aware	Gen:Variant.Zusy.378774
Sophos	Troj/Avaddon-A
BitDefenderTheta	Gen:NN.ZexaF.34722.Yu0@aGGno!fi
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	Ransom.Win32.AVADDON.SMTHA
FireEye	Generic.mg.a2cb612332632d51
Emsisoft	Gen:Variant.Zusy.378774 (B)
eGambit	Unsafe.AI_Score_100%
Microsoft	Trojan:Win32/Wacatac.B!ml
Arcabit	Trojan.Zusy.D5C796
ZoneAlarm	HEUR:Trojan.Win32.DelShad.gen
GData	Gen:Variant.Zusy.378774
AhnLab-V3	Malware/Win.Ransom.R422799
MAX	malware (ai score=88)
Panda	Trj/GdSda.A
TrendMicro-HouseCall	Ransom.Win32.AVADDON.SMTHA
Rising	Ransom.Avaddon!1.C7A8 (CLASSIC)
Fortinet	W32/Avaddon.C!tr.ransom
AVG	Win32:Trojan-gen

How to remove Zusy.378774?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

What is “Zusy.378774”?