Zusy.542015 (file analysis)

The Zusy.542015 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Zusy.542015 virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Sample contains Overlay data
• Performs HTTP requests potentially not found in PCAP.
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• Executable file is packed/obfuscated with MPRESS
• Authenticode signature is invalid
• Attempts to repeatedly call a single API many times in order to delay analysis time
• CAPE detected the shellcode get eip malware family
• Attempts to modify proxy settings
• Anomalous binary characteristics
• Yara detections observed in process dumps, payloads or dropped files

How to determine Zusy.542015?

File Info:
name: 21CABC8FC5DA698C689D.mlw
path: /opt/CAPEv2/storage/binaries/1c5b5f70a6e992906d54e846572f93124ec2967ebfc9cdf931cf3535cc1d6d35
crc32: 4FC34513
md5: 21cabc8fc5da698c689ddff3a07415cc
sha1: e5db1085bae4cb9fdd428e7de7f1052b19f30e27
sha256: 1c5b5f70a6e992906d54e846572f93124ec2967ebfc9cdf931cf3535cc1d6d35
sha512: 9d60ae57bd2711fafc787fb310c424d050f48fb1ea19213e0da793a88799724b8de8299f93e1314750ad43afc19652edb991c8718a1269114636a383b1cf942c
ssdeep: 384:UFguzjEChqLcBsMNQiviL//U8o/iYpDLQjQVf608rOppFm:UFlAL+vW//p8iKxR8r+pFm
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1481361F92EC8AA7FE27BCAB588F540CAF92175227451480D60DA874A0C13B57BCED51E
sha3_384: 1b4395064b4f929bf2779164fe4048c922af24d96f59fd2f18c996ed953b9149c1bebd930d7ad86b8446e75656b5c668
ep_bytes: 837c24120ae8b6ffffff29d101c1e889
timestamp: 2004-05-28 09:53:59

Version Info:
0: [No Data]

Zusy.542015 also known as:

How to remove Zusy.542015?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.