Categories: Malware

Zusy.406384 removal instruction

The Zusy.406384 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Zusy.406384 virus can do?

Yara rule detections observed from a process memory dump/dropped files/CAPE
Unconventionial binary language: Chinese (Simplified)
Unconventionial language used in binary resources: Chinese (Simplified)
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
A ping command was executed with the -n argument possibly to delay analysis
Uses Windows utilities for basic functionality
Deletes executed files from disk
Uses suspicious command line tools or Windows utilities

How to determine Zusy.406384?


File Info:
name: 9CF90837519B9D1CBB59.mlwpath: /opt/CAPEv2/storage/binaries/96c301bfa09338740575c4758d558b12e338654b16fc4b9d2badb9610358bf63crc32: 4EFD2A10md5: 9cf90837519b9d1cbb593ea059e3e470sha1: e08ad2511bfbf39a114f93c6c9feae48b772cb7dsha256: 96c301bfa09338740575c4758d558b12e338654b16fc4b9d2badb9610358bf63sha512: 4f14d4f9ad67026e18d542fe4dbf0041bde5add030e10dd1982a03742b41e111c6862dd8c3f1bba567f5e379fb7f74e3f5266f8bd54cfa9965b6ab510c1761a2ssdeep: 12288:7p5f9Bm+vQMf8MUF5baHjIjH1d/KqDYF3cmQpd82FiVS7YtzKMiHxJa:7F0+vQMTUvbJiVSE9UR8type: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T108D4BF32ACE02C12E3C8CAB1597F9D56CBDC3CBFB789316B11543A1522F67817AA7509sha3_384: f6bef9ff31c0fe414018a9d3711b81421172055f714d4958d3b5c4ad6959ed4f4412a142baa7620a55ece84ba671bc52ep_bytes: 558bec6aff68687d400068b05b400064timestamp: 2014-10-03 13:32:52
Version Info:
Comments: CompanyName: FileDescription: Setup/UninstallFileVersion: 51.52.0.0InternalName: LegalCopyright: LegalTrademarks: OriginalFilename: PrivateBuild: ProductName: ProductVersion: SpecialBuild: Translation: 0x0804 0x04b0

Zusy.406384 also known as:

Lionic	Trojan.Win32.Farfli.m!c
DrWeb	Trojan.MulDrop5.43520
MicroWorld-eScan	Gen:Variant.Zusy.406384
FireEye	Generic.mg.9cf90837519b9d1c
ALYac	Gen:Variant.Zusy.406384
Malwarebytes	Malware.AI.1305547685
Zillya	Trojan.Injector.Win32.1057491
Sangfor	[ARMADILLO V1.71]
K7AntiVirus	Trojan ( 0052cdd61 )
Alibaba	Backdoor:Win32/Farfli.1c0e6601
K7GW	Trojan ( 0052cdd61 )
Cybereason	malicious.7519b9
BitDefenderTheta	Gen:NN.ZexaCO.34592.Kq0@aq6fzcdb
Cyren	W32/Dropper.gen8!Maximus
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/Injector.BSDI
APEX	Malicious
TrendMicro-HouseCall	BKDR_GHOST.EJQA
Paloalto	generic.ml
Kaspersky	Backdoor.Win32.Farfli.hkq
BitDefender	Gen:Variant.Zusy.406384
NANO-Antivirus	Trojan.Win32.Drop.dmivzf
Avast	Win32:Malware-gen
Tencent	Win32.Backdoor.Farfli.Hytt
Ad-Aware	Gen:Variant.Zusy.406384
Emsisoft	Gen:Variant.Zusy.406384 (B)
Comodo	Malware@#2082ke0hfoucn
VIPRE	Gen:Variant.Zusy.406384
TrendMicro	BKDR_GHOST.EJQA
McAfee-GW-Edition	PWSZbot-FAJW!9CF90837519B
Trapmine	malicious.moderate.ml.score
Sophos	Mal/Generic-S
SentinelOne	Static AI – Malicious PE
Jiangmin	Backdoor.Farfli.flq
Webroot	W32.Trojan.Gen
Google	Detected
Avira	TR/AD.Farfli.lzrbp
MAX	malware (ai score=100)
Antiy-AVL	Trojan/Generic.ASMalwS.26E9
Kingsoft	Win32.Hack.Farfli.h.(kcloud)
Microsoft	Backdoor:Win32/Zegost!ml
ViRobot	Trojan.Win32.Z.Farfli.602112.D
GData	Gen:Variant.Zusy.406384
Cynet	Malicious (score: 99)
McAfee	PWSZbot-FAJW!9CF90837519B
VBA32	BScope.Trojan.Keyloggerger
Cylance	Unsafe
Rising	Trojan.Generic@AI.86 (RDML:/EWWhyqQuDrYwKFyKUeM7A)
Yandex	Backdoor.Farfli!bD4iP+hapBY
Ikarus	Backdoor.Farfli
MaxSecure	Trojan.Malware.7836666.susgen
Fortinet	W32/Farfli.HKQ!tr.bdr
AVG	Win32:Malware-gen
Panda	Trj/Genetic.gen
CrowdStrike	win/malicious_confidence_100% (W)