About “Zusy.406783” infection

The Zusy.406783 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Zusy.406783 virus can do?

Unconventionial language used in binary resources: Korean
Authenticode signature is invalid
Anomalous binary characteristics

How to determine Zusy.406783?


File Info:
name: D5A4060CABE3356DF787.mlw
path: /opt/CAPEv2/storage/binaries/6c6bb8cdb86d60cca4cc3e8e0e5d1715a42d1dcc06e41ba4c6392aa5c3cacd54
crc32: CB7A5529
md5: d5a4060cabe3356df7879e345eb49b84
sha1: c5ee737c513d1cbc13ccac8f0765a280a9d54170
sha256: 6c6bb8cdb86d60cca4cc3e8e0e5d1715a42d1dcc06e41ba4c6392aa5c3cacd54
sha512: a670559c20dd3d9883f6b9404ceac720a75a8ec2024d1f4a0321a9426fd90ce6284f4a8c32566fb25f1c161c74016b09f14194cb79a93539b338c125859aa027
ssdeep: 24576:ZEtxcdULALp9JL719ruVTh06cOKxNSVkFGapnbITqUygjObJA9IO0At16wKRi7:+x0GALHJ1qLcOKjJpnbIT/th0AtYwKW
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T174B51801D79741F6D687057C00EBE7CA861D5AF813277EC7A29128BB24918D0EB3E7B9
sha3_384: 14aeba136954f9fdb11fd7932d019dad9a7a06cd8151087e1dcfe305f486edbfab52e4edb26f169f64f81df39e3501d2
ep_bytes: 6a7468f0785d00e8db04000033db895d
timestamp: 2020-03-08 11:55:25

Version Info:
FileDescription: Ran-Online NPC Action Editor
FileVersion: 1.0.0.1
InternalName: NpcAction.exe
LegalCopyright: Copyright (C) 2016 JAYDev
OriginalFilename: NpcAction.exe
ProductName: ran-online
ProductVersion: 1.0.0.1
Translation: 0x0412 0x03b5

Zusy.406783 also known as:

Lionic	Trojan.Win32.Graftor.4!c
MicroWorld-eScan	Gen:Variant.Zusy.406783
FireEye	Gen:Variant.Zusy.406783
CAT-QuickHeal	Backdoor.Bifrose.28000
ALYac	Gen:Variant.Zusy.406783
Sangfor	Suspicious.Win32.Graftor.741133
CrowdStrike	win/malicious_confidence_80% (W)
TrendMicro-HouseCall	TROJ_GEN.R002H0CL821
Paloalto	generic.ml
ClamAV	Win.Trojan.Bifrose-9856903-0
BitDefender	Gen:Variant.Zusy.406783
Ad-Aware	Gen:Variant.Zusy.406783
McAfee-GW-Edition	Artemis!Trojan
Emsisoft	Gen:Variant.Zusy.406783 (B)
Ikarus	Backdoor.Win32.Bifrose
GData	Gen:Variant.Zusy.406783
Avira	HEUR/AGEN.1206828
Arcabit	Trojan.Zusy.D634FF
Microsoft	Trojan:Win32/Wacatac.B!ml
Cynet	Malicious (score: 99)
AhnLab-V3	Malware/Gen.Generic.C1247128
McAfee	Artemis!D5A4060CABE3
MAX	malware (ai score=85)
APEX	Malicious
SentinelOne	Static AI – Suspicious PE
Fortinet	W32/PossibleThreat
AVG	Win32:Malware-gen
Cybereason	malicious.cabe33
Avast	Win32:Malware-gen

How to remove Zusy.406783?

Zusy.406783 removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X