Categories: Malware

Should I remove “Zusy.442987”?

The Zusy.442987 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Zusy.442987 virus can do?

Reads data out of its own binary image
Authenticode signature is invalid
Uses Windows utilities for basic functionality
Detects Bochs through the presence of a registry key
Checks the version of Bios, possibly for anti-virtualization
Checks the CPU name from registry, possibly for anti-virtualization
Accessed credential storage registry keys
Deletes executed files from disk
Attempts to interact with an Alternate Data Stream (ADS)
Collects information to fingerprint the system
Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Zusy.442987?


File Info:
name: DEF2195F4F77E483F840.mlwpath: /opt/CAPEv2/storage/binaries/ad1059f5f6b79ce5457ece42b94262216526c0738700b78c75977f425237fddccrc32: CE827AF9md5: def2195f4f77e483f8406d08cac1680asha1: 065ff8db7ea232acb2e312f75f1a41add17522bdsha256: ad1059f5f6b79ce5457ece42b94262216526c0738700b78c75977f425237fddcsha512: c541306bd318154b57c05c81573765958fca51bed96181f0ded103a4e648b32774135e66cbb93f7a82e99ea60599f0f18b010431eb09814f2f1142557b70c124ssdeep: 24576:JCVYg0xcAbgifB4BvZpTK/kJ0EiEF+5ozolSHtn2mKgSNe5FOphi0joI19oghLNB:Jp/kJiEFsS0mK9WOzi0Q23type: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T14785BF13B191C0B2D129117215BA2B3AEA75B6128F35DED7E7D4CF692C322D1AB3720Dsha3_384: 2f99bdac5d4f314017110c66a786f8925e01f9fb16a141cc49b3b3867a271b05d53407e0063a2f7ce74c4805b84afccdep_bytes: 558bec6aff68b88d45006828c8440064timestamp: 2023-03-03 18:00:12
Version Info:
0: [No Data]

Zusy.442987 also known as:

Bkav	W32.AIDetectNet.01
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Zusy.442987
ClamAV	Win.Dropper.Tiggre-9845940-0
FireEye	Generic.mg.def2195f4f77e483
CAT-QuickHeal	Hacktool.Flystudio.16558
McAfee	Artemis!DEF2195F4F77
Cylance	unsafe
Sangfor	Trojan.Win32.Save.BlackMoon
CrowdStrike	win/malicious_confidence_70% (W)
K7GW	CryptoMiner ( 00593f811 )
K7AntiVirus	CryptoMiner ( 00593f811 )
BitDefenderTheta	Gen:NN.ZexaF.36308.YnW@aasEAcm
Cyren	W32/Coinminer.HG.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/CoinMiner.CIB
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	HEUR:Trojan.Win32.Blamon.gen
BitDefender	Gen:Variant.Zusy.442987
Avast	Win32:Evo-gen [Trj]
Tencent	Malware.Win32.Gencirc.11859f1f
Emsisoft	Gen:Variant.Zusy.442987 (B)
DrWeb	Trojan.Siggen19.61883
VIPRE	Gen:Variant.Zusy.442987
McAfee-GW-Edition	BehavesLike.Win32.Generic.th
Trapmine	malicious.high.ml.score
Sophos	Generic ML PUA (PUA)
Ikarus	Trojan.Win32.CoinMiner
GData	Gen:Variant.Zusy.442987
Avira	TR/Spy.Gen
Antiy-AVL	Trojan/Win32.FlyStudio.a
Arcabit	Trojan.Zusy.D6C26B
Microsoft	Trojan:Win32/Sabsik.FL.A!ml
AhnLab-V3	Trojan/Win.Generic.R560135
VBA32	BScope.Trojan.CryptInject
ALYac	Gen:Variant.Zusy.442987
MAX	malware (ai score=88)
Malwarebytes	FlyStudio.Trojan.MalPack.DDS
Rising	Downloader.Snojan!8.ECDD (TFE:5:BauAJWfiyYT)
SentinelOne	Static AI – Malicious PE
Fortinet	W32/CoinMiner.WP!tr
AVG	Win32:Evo-gen [Trj]