Zusy.414178 (file analysis)

The Zusy.414178 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Zusy.414178 virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Anomalous file deletion behavior detected (10+)
• Dynamic (imported) function loading detected
• At least one IP Address, Domain, or File Name was found in a crypto call
• Enumerates running processes
• Expresses interest in specific running processes
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Unconventionial language used in binary resources: Russian
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Code injection with CreateRemoteThread in a remote process
• Behavioural detection: Injection (inter-process)
• Behavioural detection: Injection with CreateRemoteThread in a remote process
• Tries to unhook or modify Windows functions monitored by Cuckoo
• Steals private information from local Internet browsers
• Collects and encrypts information about the computer likely to send to C2 server
• Attempts to modify browser security settings
• Harvests credentials from local FTP client softwares
• Clears web history

How to determine Zusy.414178?

File Info:
name: EE3D13FA7D2E3AD84E93.mlw
path: /opt/CAPEv2/storage/binaries/f357a54253f1507a1f04b2cd2f92b2779ba718535b4174b7ff8cd7044a12d3e4
crc32: 5747359F
md5: ee3d13fa7d2e3ad84e9367e9960dbcd8
sha1: 3c34cc62c6108717e7515d91c0e5b7d5b07e0fae
sha256: f357a54253f1507a1f04b2cd2f92b2779ba718535b4174b7ff8cd7044a12d3e4
sha512: ddef03d874c8aeb6b520cebe6c13e8b731c41ff4f1d14a1a9e46d41f4c365c3f9b5870f27c2d99187bea421cecc2ce64121a53dadbc93ed2728ed465f312b4a7
ssdeep: 3072:8U2qobrJPYV8e3DrFDZdA8l1t90SaOzAqsrEp6LnKSzwGFpLowGfMD5HEL1:X2qCrJ2VfAovaOzdsQMK98pLTGfX
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T13424DF22ADD39833E37D51F48F25F92288172C81532D45729FB4066A9EAF9C0C7FA352
sha3_384: d871bc75edc0d07bb391f44fdd1289704eec7c2fba2b604893a608808bc25d96047fa33b08918481f17f0e823e79a35b
ep_bytes: e840190000e989feffff8bff558bec81
timestamp: 2011-10-19 15:08:12

Version Info:
CompanyName: Advanced Micro Devices, Inc.
FileDescription: ATI Maintaince
FileVersion: 3.0.741.0
InternalName: ATI Maintaince
LegalCopyright: Copyright (C) 2011
OriginalFilename: ATIMaintaince.exe
ProductName: CATALYST™ Console Manager
ProductVersion: 3.0.741.0
Translation: 0x0409 0x04b0

Zusy.414178 also known as:

How to remove Zusy.414178?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.