Zusy.397677 removal instruction

The Zusy.397677 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Zusy.397677 virus can do?

• Behavioural detection: Executable code extraction – unpacking
• SetUnhandledExceptionFilter detected (possible anti-debug)
• At least one process apparently crashed during execution
• Executed a command line with /C or /R argument to terminate command shell on completion which can be used to hide execution
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Dynamic (imported) function loading detected
• Enumerates running processes
• A process created a hidden window
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• Unconventionial language used in binary resources: Chinese (Simplified)
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• A ping command was executed with the -n argument possibly to delay analysis
• Uses Windows utilities for basic functionality
• Behavioural detection: Transacted Hollowing
• Created a process from a suspicious location
• Steals private information from local Internet browsers
• Installs itself for autorun at Windows startup
• Installs itself for autorun at Windows startup
• Likely virus infection of existing system binary
• Creates a copy of itself

Related domains:

How to determine Zusy.397677?

File Info:
name: 6A66A6711774BE0FD385.mlw
path: /opt/CAPEv2/storage/binaries/5d3978a285dd391dd1f471eebe9428d0b6ca64ea85103557b4289612d94e23c9
crc32: 541DE513
md5: 6a66a6711774be0fd38564d2a3de5a76
sha1: 4ce5366e5e807b64330116381607d0f876c8c90a
sha256: 5d3978a285dd391dd1f471eebe9428d0b6ca64ea85103557b4289612d94e23c9
sha512: c524bbf556cb45c13cba654fc8a15556ed5d4845d4da911b55b06d044563f075843d5a6e5c4634a91d4e53abaf3091ef196c4c491f52c06a954780dc565b57c4
ssdeep: 24576:9VJ6cUOB7XwVhZG6MqQ+VfNBWgYvqoVMOn5vFVpcBTnVMp+HXQBm8V2X6P/zK2dO:orIXUdDhYvq6n5vC9e8XQ4SzlDqj
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1E695AF6AD61BC404D1F05AFDA723B3C4176C5D126B3CEAE352D5767A65F8BC02B22A03
sha3_384: cdcba329e9db855c983b35ab2d0b52c402978a2af369589038ec85631a29a52b15fb0a3315fc513680e977871ff878ca
ep_bytes: 558bec6aff6848675700682041570064
timestamp: 2021-08-14 03:13:00

Version Info:
0: [No Data]

Zusy.397677 also known as:

How to remove Zusy.397677?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.