Zusy.456639 (file analysis)

The Zusy.456639 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Zusy.456639 virus can do?

Sample contains Overlay data
Presents an Authenticode digital signature
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
Anomalous binary characteristics

How to determine Zusy.456639?


File Info:
name: 65C292683F7FD0BE4FDB.mlw
path: /opt/CAPEv2/storage/binaries/c8a85116099d4dde0ac4f06ffd4d943060b85e75e773b81a87fb0382fccc4178
crc32: C42248BD
md5: 65c292683f7fd0be4fdb58311b2851a8
sha1: f74492a23de2af3facfd564a5a0d3a2ed839b82b
sha256: c8a85116099d4dde0ac4f06ffd4d943060b85e75e773b81a87fb0382fccc4178
sha512: 2399fcc9237e62de3a98c2ff324a136aec3ddf36458dca35914ae346692480e4c48de9c00eb730c4dd28540b567cd711d885b8df218bbe872bcc149970ebbcc5
ssdeep: 24576:23m+ex85KmMj9DENY9Q3RpSbbSOd//28:23pexPmG9DENYCFOd//v
type: PE32 executable (console) Intel 80386, for MS Windows
tlsh: T1BF15128B21C584B0C531D7FF84F2F26A11AE2D1233E1559733DCA94F592D5A62B2CE2E
sha3_384: 26181c9ca37e33e70971896e2613d9edbf196fffcdf942939ac2e20005e6833b9ba2e50e7ff59aed28e75cf0db84bbae
ep_bytes: e8173c0000e9a4feffff3b0dec0c4e00
timestamp: 2023-04-06 14:14:31

Version Info:
Comments: Shoots mangler bimonthly polyethylene
CompanyName: Regressive
FileDescription: Maternal allowances addressability
FileVersion: 5.250.269.2
InternalName: Facetiousness
LegalCopyright: Copyright Â© Smacked overeating signor catalysing chinese waterfront
LegalTrademarks: Peafowl rant
OriginalFilename: Gilded
ProductName: Commissariat pluralists
ProductVersion: 5.250.269.2
Translation: 0x081a 0x081a

Zusy.456639 also known as:

Elastic	malicious (high confidence)
DrWeb	Trojan.Inject4.55719
MicroWorld-eScan	Gen:Variant.Zusy.456639
ALYac	Gen:Variant.Zusy.456639
Cylance	unsafe
VIPRE	Gen:Variant.Zusy.456639
K7AntiVirus	Trojan ( 0059d50d1 )
K7GW	Trojan ( 0059d50d1 )
CrowdStrike	win/malicious_confidence_70% (D)
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Kryptik.HSEV
APEX	Malicious
Cynet	Malicious (score: 99)
Kaspersky	HEUR:Trojan.Win32.Strab.gen
BitDefender	Gen:Variant.Zusy.456639
Avast	Win32:CrypterX-gen [Trj]
Tencent	Win32.Trojan.FalseSign.Czlw
Emsisoft	Gen:Variant.Zusy.456639 (B)
F-Secure	Trojan.TR/AD.Nekark.mlikh
McAfee-GW-Edition	Artemis!Trojan
Trapmine	malicious.high.ml.score
FireEye	Generic.mg.65c292683f7fd0be
SentinelOne	Static AI – Suspicious PE
GData	Gen:Variant.Zusy.456639
Avira	TR/AD.Nekark.mlikh
MAX	malware (ai score=89)
Antiy-AVL	Trojan/Win32.Kryptik
Arcabit	Trojan.Zusy.D6F7BF
ZoneAlarm	HEUR:Trojan.Win32.Strab.gen
Microsoft	Trojan:Win32/SmokeLoader.C!MTB
Google	Detected
AhnLab-V3	Trojan/Win.RedLine.R568614
Acronis	suspicious
McAfee	GenericRXVT-AB!65C292683F7F
VBA32	BScope.Trojan.Sabsik.FL
Malwarebytes	Trojan.Injector
Rising	Backdoor.Agent!8.C5D (TFE:5:yYwmlu0Q3jE)
Ikarus	Trojan.Win32.Crypt
Fortinet	W32/Kryptik.HSEV!tr
AVG	Win32:CrypterX-gen [Trj]
DeepInstinct	MALICIOUS

How to remove Zusy.456639?

Zusy.456639 removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X