Categories: Malware

What is “Zusy.408720”?

The Zusy.408720 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Zusy.408720 virus can do?

SetUnhandledExceptionFilter detected (possible anti-debug)
At least one process apparently crashed during execution
Yara rule detections observed from a process memory dump/dropped files/CAPE
Creates RWX memory
Dynamic (imported) function loading detected
Performs HTTP requests potentially not found in PCAP.
HTTPS urls from behavior.
Unconventionial binary language: Chinese (Simplified)
Unconventionial language used in binary resources: Chinese (Simplified)
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid
Attempts to modify proxy settings

How to determine Zusy.408720?


File Info:
name: 06FF63CBE7E69B2EFAEB.mlwpath: /opt/CAPEv2/storage/binaries/45689c41029cb8748f470739a274163f41daa12e36309251ebf886517381f43fcrc32: CF33CFF9md5: 06ff63cbe7e69b2efaeba4ecd60cc79csha1: be6a21ba764239192894e0424cfadc4764215b49sha256: 45689c41029cb8748f470739a274163f41daa12e36309251ebf886517381f43fsha512: 4083265d0fc5df082e0f76f9aeea8227741dc75e5eba79b43e56d769d737a789743ca7d9d5e3b7ad4bfa27f6887349193aa215c9bca45dc4bc059dbe6e24ddecssdeep: 12288:6k9fTtJulwSyEmwTmNR25XJFlrmcKkZM3RnMJOg8zlXmgx+BAojL0W:H7SzTm725XdmtlngilXmgx+BAojL0Wtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1F1E449C23870C8F5F97585B01AB6AE6CA2507DE59E22076F3684F6DA5AF30CD313245Dsha3_384: 279e3778b47a749e2e8a6b80747b5c99f351dccfec36322b63c86a77ed67bdfce6c90d09022cba1d1e3c6e48ab6d4b5fep_bytes: 558bec6aff6810ff450068308b410064timestamp: 2021-11-26 10:39:42
Version Info:
CompanyName: FileDescription: showsgy Microsoft 基础类应用程序FileVersion: 1, 0, 0, 1InternalName: showsgyLegalCopyright: 版权所有 (C) 2006LegalTrademarks: OriginalFilename: showsgy.EXEProductName: showsgy 应用程序ProductVersion: 1, 0, 0, 1Translation: 0x0804 0x04b0

Zusy.408720 also known as:

Bkav	W32.AIDetect.malware1
Lionic	Trojan.Multi.GenericML.4!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Zusy.408720
FireEye	Generic.mg.06ff63cbe7e69b2e
ALYac	Gen:Variant.Zusy.408720
Malwarebytes	Malware.AI.3951853296
K7AntiVirus	Trojan-Downloader ( 005894c11 )
Alibaba	TrojanDownloader:Win32/BackdoorX.9f11ddc0
K7GW	Trojan-Downloader ( 005894c11 )
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/TrojanDownloader.Agent.FYH
APEX	Malicious
Avast	Win32:BackdoorX-gen [Trj]
Kaspersky	UDS:Trojan.Multi.GenericML.xnet
BitDefender	Gen:Variant.Zusy.408720
Tencent	Win32.Trojan-downloader.Agent.Hzj
Ad-Aware	Gen:Variant.Zusy.408720
Emsisoft	Gen:Variant.Zusy.408720 (B)
McAfee-GW-Edition	BehavesLike.Win32.Dropper.jh
Sophos	Mal/Generic-S
GData	Gen:Variant.Zusy.408720
Jiangmin	Trojan.Multi.fmk
Avira	TR/Dldr.Agent.dzeae
Gridinsoft	Trojan.Win32.Downloader.sa
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
Cynet	Malicious (score: 99)
AhnLab-V3	Trojan/Win.Generic.R454640
McAfee	Artemis!06FF63CBE7E6
MAX	malware (ai score=85)
VBA32	BScope.Trojan.Zenpak
Cylance	Unsafe
TrendMicro-HouseCall	TROJ_GEN.R002H0CKS21
SentinelOne	Static AI – Suspicious PE
Fortinet	W32/Agent.FYH!tr.dldr
BitDefenderTheta	Gen:NN.ZexaF.34062.Qu1@aKJWJrib
AVG	Win32:BackdoorX-gen [Trj]
CrowdStrike	win/malicious_confidence_90% (W)
MaxSecure	Trojan.Malware.300983.susgen