Zusy.408156 removal

The Zusy.408156 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Zusy.408156 virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Dynamic (imported) function loading detected
• Performs HTTP requests potentially not found in PCAP.
• HTTPS urls from behavior.
• CAPE extracted potentially suspicious content
• Unconventionial language used in binary resources: Spanish (Paraguay)
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Steals private information from local Internet browsers
• Attempts to modify proxy settings
• Harvests cookies for information gathering

Related domains:

How to determine Zusy.408156?

File Info:
name: 6F892F86830BF30B3F33.mlw
path: /opt/CAPEv2/storage/binaries/bd230bb2b4f83fbc4d39ac6e3e0f65a8756c6b815dd91f094e8ebad7d702735f
crc32: 17D4D1B4
md5: 6f892f86830bf30b3f3363a352918e71
sha1: 5c179e225028a7b2e71215eb2c4624942f9c6d7b
sha256: bd230bb2b4f83fbc4d39ac6e3e0f65a8756c6b815dd91f094e8ebad7d702735f
sha512: 192a9044de66becf9493cac7357abf399bbbdef3c5cffc34952d1933707bd659cce8222afe9bd33cbe27c82f3d9c3421182ebf7cad0619513d2d573c9dd6d8bc
ssdeep: 6144:Qvt3uCqsjJn9bsQLsZe/VI39s+gKkGz/gY:QvBK8n1sQLsZetIdgKkm
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T15364AF0077A0C43AF5B717F899B993A5693EBEA16B24D0CF62D127EA46356D0DC31307
sha3_384: 9edbe0467ba1bc86f240263c685c025207f794719f652dda48f26a7063ca0e5f8e6b63f377c2e5f84130c363729a3782
ep_bytes: 8bff558bece806030000e8110000005d
timestamp: 2020-07-01 15:29:34

Version Info:
0: [No Data]

Zusy.408156 also known as:

How to remove Zusy.408156?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.