Malware

About “Zusy.393825 (B)” infection

Malware Removal

The Zusy.393825 (B) is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Zusy.393825 (B) virus can do?

  • SetUnhandledExceptionFilter detected (possible anti-debug)
  • Presents an Authenticode digital signature
  • Dynamic (imported) function loading detected
  • Performs HTTP requests potentially not found in PCAP.
  • HTTPS urls from behavior.
  • The binary contains an unknown PE section name indicative of packing
  • Authenticode signature is invalid
  • Network activity contains more than one unique useragent.
  • Collects information about installed applications
  • Attempts to modify proxy settings

How to determine Zusy.393825 (B)?



File Info:

name: C056F88300B53FC73641.mlw
path: /opt/CAPEv2/storage/binaries/d2b7743cb9a310a8a318af3f0c56897f1f2aa54d294c2433e91cee1ed8b0f15b
crc32: 32C699C9
md5: c056f88300b53fc7364159e597a233bd
sha1: 263938aa2b8824d5a450476a452bef24f42ad980
sha256: d2b7743cb9a310a8a318af3f0c56897f1f2aa54d294c2433e91cee1ed8b0f15b
sha512: c30cb7da1349583dd767bffd6de8d694b70124e1315dc4e4965b9b6b977e603a8ca9c9787d32241da97ba90c6a643a46e868c0d171e288dc1678f5b0fa24c83c
ssdeep: 49152:frMYf2c99gFzFMERhmn1W6oQomgcwuwypq7v1ZylH123fYb1Ahj9BuakffVigMJ7:DMa2NMJxwuwiq7vzyt1YfYb1K9Bupff0
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1DFD59D217DE14677C52303315ACDF23931AEFE740736818B23863F1C6D74E62666AAA7
sha3_384: 231e5d7609c528e204f67113a7eba5d80006bd8b42b8050790f39792fe7e3897d179e171ec43d7585993810de3002885
ep_bytes: e8370c0000e98efeffff3b0d78005f00
timestamp: 2018-08-26 00:51:17


Version Info:

CompanyName: PlusPlusZero
FileDescription: PPZ
FileVersion: 4.1.1.3
InternalName: PPZ
LegalCopyright: Copyright 2018 PlusPlusZero
OriginalFilename: PPZ
ProductName: PPZ
ProductVersion: 4.1.1.3
Translation: 0x0813 0x04e4

Zusy.393825 (B) also known as:

BkavW32.AIDetect.malware1
LionicRiskware.Win32.Razy.1!c
Elasticmalicious (high confidence)
MicroWorld-eScanGen:Variant.Zusy.393825
FireEyeGeneric.mg.c056f88300b53fc7
McAfeeGenericRXAA-AA!C056F88300B5
CylanceUnsafe
ZillyaAdware.OpenSUpdater.Win32.537
SangforAdware.Win32.Generic.ky
AlibabaAdWare:Win32/OpenSUpdater.b644e207
SymantecML.Attribute.HighConfidence
ESET-NOD32a variant of Win32/Adware.OpenSUpdater.DD
APEXMalicious
Kasperskynot-a-virus:HEUR:AdWare.Win32.Generic
BitDefenderGen:Variant.Zusy.393825
AvastWin32:AdwareX-gen [Adw]
RisingTrojan.Generic@ML.80 (RDML:+iOlnr0ICzdFv+ANjwyW/Q)
Ad-AwareGen:Variant.Zusy.393825
EmsisoftGen:Variant.Zusy.393825 (B)
ComodoApplicUnwnt@#1le75wrs4yd3n
DrWebAdware.Searcher.3256
TrendMicroTROJ_GEN.R002C0WIK21
McAfee-GW-EditionArtemis!PUP
SophosGeneric PUA CG (PUA)
SentinelOneStatic AI – Malicious PE
GDataGen:Variant.Zusy.393825
JiangminAdWare.Generic.uhbj
Antiy-AVLTrojan/Generic.ASMalwS.2912E3A
ArcabitTrojan.Zusy.D60261
ViRobotAdware.Opensupdater.2814240.A
MicrosoftPUADlManager:Win32/OpenDownloadManager
BitDefenderThetaGen:NN.ZexaF.34294.R21@a8HAE8fO
ALYacGen:Variant.Zusy.393825
MAXmalware (ai score=80)
VBA32Adware.Searcher
MalwarebytesPUP.Optional.SpecialSearchOffer
TrendMicro-HouseCallTROJ_GEN.R002C0WIK21
TencentTrojan.Win32.BitCoinMiner.la
YandexTrojan.GenAsa!imLGNA7Oegs
MaxSecureTrojan.Malware.300983.susgen
FortinetRiskware/OpenSUpdater
AVGWin32:AdwareX-gen [Adw]
Cybereasonmalicious.300b53
PandaTrj/Genetic.gen

How to remove Zusy.393825 (B)?

Zusy.393825 (B) removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment