Should I remove “Zusy.423830”?

The Zusy.423830 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Zusy.423830 virus can do?

• Behavioural detection: Executable code extraction – unpacking
• SetUnhandledExceptionFilter detected (possible anti-debug)
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• NtSetInformationThread: attempt to hide thread from debugger
• Possible date expiration check, exits too soon after checking local time
• Guard pages use detected – possible anti-debugging.
• Dynamic (imported) function loading detected
• Performs HTTP requests potentially not found in PCAP.
• Enumerates the modules from a process (may be used to locate base addresses in process injection)
• Enumerates running processes
• Drops a binary and executes it
• Unconventionial binary language: Chinese (Simplified)
• Unconventionial language used in binary resources: Chinese (Simplified)
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• Executable file is packed/obfuscated with Themida
• Authenticode signature is invalid
• CAPE detected the XiaoBa malware family
• Checks the version of Bios, possibly for anti-virtualization
• Detects VirtualBox through the presence of a registry key
• Attempts to modify proxy settings
• Creates a copy of itself
• Anomalous binary characteristics

How to determine Zusy.423830?

File Info:
name: BF5B89BA954AD0A228AC.mlw
path: /opt/CAPEv2/storage/binaries/568e257078ac5cd7a397371e8c776ce98e02573e5d76455d5217fe88f770018f
crc32: 38B04D9F
md5: bf5b89ba954ad0a228acc62b8e09b47b
sha1: cbda9d17ecde4713508344480a031a407c7420de
sha256: 568e257078ac5cd7a397371e8c776ce98e02573e5d76455d5217fe88f770018f
sha512: 7c264767e2155abfa9d3913c8acf3a30b6d7c6fbb0b44fe4dc8562729511573261d659c30b6beade1e3b13bf3dedf7876128fcbfe13d8e4af494421d1c67bf1d
ssdeep: 196608:oUy/1WGWuy3P84dmMgMKWQ3UIm49ByTRfB5RDaDoMxmSXd4CY1FeLx6Es:oUy/18BdvgVQ4Pyb5io4SFeM
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T171C633F91C23966CC5F2C37497930B236DD28E0E60F9BFAE562BE14E48B8453AB05475
sha3_384: 57131192236efc63923a8df5ddf1e8c9c15b344205504d9da34f2491439e03af2a3a4bcbc615ce61f05d10899e9aecfa
ep_bytes: e84b0100005389e3538b73088b7b10fc
timestamp: 2022-06-28 11:49:35

Version Info:
FileVersion: 1.0.0.0
FileDescription: QQ:1584281113
ProductName: 私服登录器
ProductVersion: 1.0.0.0
LegalCopyright: 作者版权所有 请尊重并使用正版
Comments: 本程序使用易语言编写(http://www.eyuyan.com)
Translation: 0x0804 0x04b0

Zusy.423830 also known as:

How to remove Zusy.423830?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.