Categories: Malware

Zusy.442987 removal tips

The Zusy.442987 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Zusy.442987 virus can do?

Reads data out of its own binary image
Authenticode signature is invalid
Uses Windows utilities for basic functionality
Detects Bochs through the presence of a registry key
Checks the version of Bios, possibly for anti-virtualization
Checks the CPU name from registry, possibly for anti-virtualization
Accessed credential storage registry keys
Deletes executed files from disk
Collects information to fingerprint the system
Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Zusy.442987?


File Info:
name: 8408B23F47FBEBCAD535.mlwpath: /opt/CAPEv2/storage/binaries/ae84ca350c57df4277fe8f6b2f6f5f1bc0791027be4ff387e3ba6d2cb36baf3dcrc32: 51E644ECmd5: 8408b23f47fbebcad5352e4fbcf3e59bsha1: b172a391ba9aff0772d5d671992490ee7b06dfd1sha256: ae84ca350c57df4277fe8f6b2f6f5f1bc0791027be4ff387e3ba6d2cb36baf3dsha512: f1fdc5851ade7891fa26382b760b95e5e9ec853da35dff672a6ad67844590d4295c90897e61bc83da502535323011c0a0f97d1e04bb88c7add026c552633a358ssdeep: 24576:T8pbsZQTzb4z4BRZfJK/kJfOREF+5ozolSHtn2mKgSNe5FOphi0joI19oghLNKNo:Tv/kJOEFsS0mK9WOzi0Q2ftype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T18C85BF13B191C0B2D129117215BA2B3AEA75B6128F35DED7E7D4CF692C322D1AB3720Dsha3_384: d4b80a5a3ba719f966b68fdf8d8eaf0b340538f7e0af4d187ebc8110b80c5b001c5de479e9c3039e6f59189591dcd040ep_bytes: 558bec6aff68b88d45006898c8440064timestamp: 2023-02-28 09:09:43
Version Info:
0: [No Data]

Zusy.442987 also known as:

Bkav	W32.AIDetectNet.01
MicroWorld-eScan	Gen:Variant.Zusy.442987
CAT-QuickHeal	Hacktool.Flystudio.16558
ALYac	Gen:Variant.Zusy.442987
Cylance	unsafe
Sangfor	Trojan.Win32.Save.BlackMoon
Cybereason	malicious.f47fbe
Cyren	W32/Coinminer.HG.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/CoinMiner.CIB
APEX	Malicious
ClamAV	Win.Dropper.Tiggre-9845940-0
Kaspersky	HEUR:Trojan.Win32.Blamon.gen
BitDefender	Gen:Variant.Zusy.442987
Avast	Win32:Evo-gen [Trj]
Emsisoft	Gen:Variant.Zusy.442987 (B)
DrWeb	Trojan.Siggen19.61146
VIPRE	Gen:Variant.Zusy.442987
McAfee-GW-Edition	BehavesLike.Win32.Generic.th
Trapmine	malicious.high.ml.score
FireEye	Generic.mg.8408b23f47fbebca
Sophos	BlackMoon Packed (PUA)
SentinelOne	Static AI – Malicious PE
GData	Win32.Trojan.PSE.1KQMTX4
Avira	TR/Spy.Gen
Antiy-AVL	Trojan/Win32.FlyStudio.a
Arcabit	Trojan.Zusy.D6C26B
ZoneAlarm	not-a-virus:Downloader.Win32.Snojan.gzif
Microsoft	Trojan:Win32/Wacatac.B!ml
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win.Generic.R560135
McAfee	Artemis!8408B23F47FB
MAX	malware (ai score=89)
VBA32	BScope.Trojan.CryptInject
Malwarebytes	FlyStudio.Trojan.MalPack.DDS
Rising	Downloader.Snojan!8.ECDD (TFE:5:BauAJWfiyYT)
Ikarus	Trojan.Win32.CoinMiner
Fortinet	W32/CoinMiner.WP!tr
BitDefenderTheta	Gen:NN.ZexaF.36308.YnW@a0tqd8j
AVG	Win32:Evo-gen [Trj]