About “Zusy.412886” infection

The Zusy.412886 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Zusy.412886 virus can do?

The binary contains an unknown PE section name indicative of packing
The executable is compressed using UPX
Authenticode signature is invalid

How to determine Zusy.412886?


File Info:
name: 1F2B3F411A643CF41AEE.mlw
path: /opt/CAPEv2/storage/binaries/23a23e75627bda1a884762bc5a99a135d180f8e27254de38d00e9f66762619e1
crc32: C6616AA6
md5: 1f2b3f411a643cf41aeebec834069273
sha1: 1b3a7ab6a995404c168d470074f4d3b810f6fc7e
sha256: 23a23e75627bda1a884762bc5a99a135d180f8e27254de38d00e9f66762619e1
sha512: 1343ac586425e624c268f4cb4f02ee278eb8c3d0924dd5e80855c1cfcfdfb7a2122fed1b15638a7635493d1c82ffeddab0acdb0e99aa664ab9b6289f9a3b47ce
ssdeep: 49152:HsLfUxC+R2zNsnKvkTgXuquveY+W2o8oT3ezMrl9cekcHhXh9HJUiWUXsmqsqzl0:++RYNAKvkTgXuquveY+W2o8oT3ezMrln
type: PE32 executable (console) Intel 80386, for MS Windows
tlsh: T13EC5D6C2A6D39877C4A929705991DA0836247FD08513BE8BF2147ECDFBBE690AD1C335
sha3_384: b566fb070fb74a9b7db455f77b9e35714cea9d45b1dddb382189be41ba8b2bdc15af1f4366b8905b50c95fcf0accfa6a
ep_bytes: 40554883ec20488bea488b5528488b4d
timestamp: 1970-01-01 00:00:00

Version Info:
0: [No Data]

Zusy.412886 also known as:

Bkav	W32.AIDetect.malware1
Elastic	malicious (high confidence)
DrWeb	Win32.HLLW.Autoruner.547
MicroWorld-eScan	Gen:Variant.Zusy.412886
FireEye	Generic.mg.1f2b3f411a643cf4
ALYac	Gen:Variant.Zusy.412886
Cylance	Unsafe
Sangfor	Virus.Win32.Save.a
CrowdStrike	win/malicious_confidence_90% (W)
BitDefenderTheta	Gen:NN.ZexaE.34182.HoZ@aSwM69k
Cyren	W32/Sabsik.W.gen!Eldorado
Symantec	Trojan.Gen.2
TrendMicro-HouseCall	TROJ_GEN.R03BH09AQ22
ClamAV	Win.Dropper.Ausiv-9876732-0
BitDefender	Gen:Variant.Zusy.412886
Avast	Win32:VB-FBX
Ad-Aware	Gen:Variant.Zusy.412886
Sophos	Generic ML PUA (PUA)
Comodo	Packed.Win32.MUPX.Gen@24tbus
McAfee-GW-Edition	BehavesLike.Win32.Generic.vm
Emsisoft	Gen:Variant.Zusy.412886 (B)
Ikarus	Trojan.Win32
GData	Gen:Variant.Zusy.412886
Jiangmin	Packed.Krap.gvxl
Microsoft	Trojan:Script/Phonzy.A!ml
Cynet	Malicious (score: 100)
AhnLab-V3	Malware/Win.VB.R467414
McAfee	Artemis!1F2B3F411A64
MAX	malware (ai score=85)
VBA32	Trojan.Sdum
Malwarebytes	Malware.AI.3696146603
APEX	Malicious
Rising	Worm.VB!1.DA3E (RDMK:cmRtazoIBRnvRtd49bzLwTtFADh+)
Yandex	Trojan.Agent!KdXPpfOf6BY
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.121218.susgen
Fortinet	W32/Sabsik.B!tr
AVG	Win32:VB-FBX
Cybereason	malicious.6a9954

How to remove Zusy.412886?

Zusy.412886 removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X