Categories: Malware

Should I remove “Zusy.390723”?

The Zusy.390723 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Zusy.390723 virus can do?

SetUnhandledExceptionFilter detected (possible anti-debug)
Dynamic (imported) function loading detected
Yara rule detections observed from a process memory dump/dropped files/CAPE
Possible date expiration check, exits too soon after checking local time
Enumerates the modules from a process (may be used to locate base addresses in process injection)
CAPE extracted potentially suspicious content
Authenticode signature is invalid
CAPE detected the RedLine malware family
Anomalous binary characteristics

How to determine Zusy.390723?


File Info:
name: 70849F24AB9AA48590AC.mlwpath: /opt/CAPEv2/storage/binaries/e6ad87c42a1ee6affe5641ab2e0f2b97d802c898aab8bdc5fe9568de99f8ca25crc32: 48ADA392md5: 70849f24ab9aa48590ac7a4a8b92030dsha1: 0950ca783678d3cfbe091aaa33ff47efcf41cc57sha256: e6ad87c42a1ee6affe5641ab2e0f2b97d802c898aab8bdc5fe9568de99f8ca25sha512: 86c067de159a71bb18b445879782c9d2e2830b232b20a0236cba27513743da08e48691388da4ddba8e2376883e2290dc7912613e3f7b991298992545fa32fe15ssdeep: 1536:CxKY+T6KW5CvEyXWvE344wAL5LO8XvdPTwZI3sq5gnToIfnIOlIOjcTp5X/OO0Lh:4DKW1LgppLRHMY0TBfJvjcTp5X/LKqNotype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T113F39D1175C1C2B3C4B7113044E6CA7A9A3A3471477A95D7BBDD1BBA6E203E1A3362C9sha3_384: d04c04c015ded60ea7341ae77116357eefbf0f86e09e8958b762227edcaaacdba284cddbbbd6e99555325c1d8b87219cep_bytes: e8e15c0000e9a4feffff8bff558bec83timestamp: 2012-07-13 22:47:16
Version Info:
Translation: 0x0000 0x04b0Comments: CompanyName: FileDescription: WindowsFormsApp1FileVersion: 1.0.0.0InternalName: WindowsFormsApp1.exeLegalCopyright: Copyright ©  2022LegalTrademarks: OriginalFilename: WindowsFormsApp1.exeProductName: WindowsFormsApp1ProductVersion: 1.0.0.0Assembly Version: 1.0.0.0

Zusy.390723 also known as:

tehtris	Generic.Malware
Cylance	Unsafe
CrowdStrike	win/malicious_confidence_60% (D)
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of MSIL/TrojanDownloader.Agent.KJQ
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	HEUR:Trojan-Spy.Win32.Stealer.vho
BitDefender	Gen:Variant.Zusy.390723
SUPERAntiSpyware	Trojan.Agent/Gen-MSIL
MicroWorld-eScan	Gen:Variant.Zusy.390723
Rising	Trojan.Generic@AI.100 (RDMK:cmRtazr55dRdElbRfldIcNIsay25)
Ad-Aware	Gen:Variant.Zusy.390723
Emsisoft	Gen:Variant.Zusy.390723 (B)
McAfee-GW-Edition	BehavesLike.Win32.Generic.cc
FireEye	Generic.mg.70849f24ab9aa485
Sophos	Generic ML PUA (PUA)
SentinelOne	Static AI – Malicious PE
GData	Gen:Variant.Zusy.390723
Arcabit	Trojan.Zusy.D5F643
ZoneAlarm	HEUR:Trojan-Spy.Win32.Stealer.vho
Microsoft	Backdoor:Win32/Bladabindi!ml
ALYac	Gen:Variant.Zusy.390723
MAX	malware (ai score=88)
Ikarus	Trojan-Downloader.MSIL.Small
MaxSecure	Trojan.Malware.300983.susgen
BitDefenderTheta	Gen:NN.ZexaF.34638.kq0@a4Mn6Uc