Categories: Malware

Zusy.385046 removal guide

The Zusy.385046 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Zusy.385046 virus can do?

Behavioural detection: Executable code extraction – unpacking
SetUnhandledExceptionFilter detected (possible anti-debug)
Presents an Authenticode digital signature
Creates RWX memory
Dynamic (imported) function loading detected
Reads data out of its own binary image
CAPE extracted potentially suspicious content
Unconventionial language used in binary resources: Chinese (Simplified)
The binary contains an unknown PE section name indicative of packing
The binary likely contains encrypted or compressed data.
The executable is compressed using UPX
Authenticode signature is invalid
Anomalous binary characteristics

How to determine Zusy.385046?


File Info:
name: 39E5F1A83970B434C35A.mlwpath: /opt/CAPEv2/storage/binaries/54fc13187c49f52e206bcb31e980ed8195456b6025ed7d80ce05b943d3168eeccrc32: 16D0D86Amd5: 39e5f1a83970b434c35ae2e3c2ed6701sha1: 5600d182903c1d28f49e5586b7b9f17454055863sha256: 54fc13187c49f52e206bcb31e980ed8195456b6025ed7d80ce05b943d3168eecsha512: 9a8e0ba61bdb2aeea88a4b613f022d29cc01f7bf9a14263d8d2aa5870b639c41fbceb5ba52133804a5321429b90ca978df62d9021629c9042b2a456008073f2essdeep: 49152:Obz7wOtjhXbpl5HEnqftDwIBenf6KNMfA3T4dWICAqDkkhEuzjFfWP:Ob3fjhXLBEnS0IBef6KTT+WIHgkmVtCtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T154C533037159A4B0EACA9B7E80136D4E5D5BE338E8ECFF86C5016509A8BDBC35E0857Dsha3_384: 8dfdd7d7adb99fc0626a78390af54efc1ac199ab79bce36fc1d5c7cff983b99d82b97568c4ccdea63b707220995edd9cep_bytes: 9c55539cc744240cfe8ebbb4c704249etimestamp: 2016-10-19 16:20:22
Version Info:
0: [No Data]

Zusy.385046 also known as:

Bkav	W32.AIDetect.malware2
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Zusy.385046
FireEye	Generic.mg.39e5f1a83970b434
McAfee	GenericRXAA-AA!39E5F1A83970
Zillya	Tool.GameHack.Win32.10615
K7AntiVirus	Riskware ( 0055997e1 )
K7GW	Riskware ( 0055997e1 )
Cybereason	malicious.83970b
BitDefenderTheta	Gen:NN.ZexaF.34062.AUZ@a82MWQkj
Cyren	W32/OnlineGames.CP.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/RiskWare.GameHack.DP
TrendMicro-HouseCall	TROJ_GEN.R035H0CL621
ClamAV	Win.Malware.Razy-9646838-0
BitDefender	Gen:Variant.Zusy.385046
Avast	Win32:Malware-gen
Tencent	Malware.Win32.Gencirc.10cf00e0
Ad-Aware	Gen:Variant.Zusy.385046
Emsisoft	Gen:Variant.Zusy.385046 (B)
VIPRE	Trojan.Win32.OnlineGames
McAfee-GW-Edition	BehavesLike.Win32.PUPXBO.vc
Sophos	Generic ML PUA (PUA)
Ikarus	Trojan.Spy.Banker
GData	Gen:Variant.Zusy.385046
eGambit	Unsafe.AI_Score_90%
Avira	HEUR/AGEN.1103221
Antiy-AVL	Trojan/Generic.ASMalwS.207E2E1
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
Cynet	Malicious (score: 100)
VBA32	BScope.Trojan.MulDrop
ALYac	Gen:Variant.Zusy.385046
MAX	malware (ai score=88)
Cylance	Unsafe
APEX	Malicious
Rising	Malware.Heuristic!ET#100% (RDMK:cmRtazrGdd5LXTK2VocCnpCGPDKR)
Yandex	Trojan.GenAsa!P79O5FW7VUI
SentinelOne	Static AI – Malicious PE
Fortinet	Riskware/GameHack
AVG	Win32:Malware-gen
CrowdStrike	win/malicious_confidence_60% (W)