Categories: Malware

What is “Bulz.164936”?

The Bulz.164936 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Bulz.164936 virus can do?

Yara rule detections observed from a process memory dump/dropped files/CAPE
Creates RWX memory
Dynamic (imported) function loading detected
Enumerates running processes
The binary contains an unknown PE section name indicative of packing
The binary likely contains encrypted or compressed data.
The executable is likely packed with VMProtect
Authenticode signature is invalid
Tries to suspend Cuckoo threads to prevent logging of malicious activity
Tries to unhook or modify Windows functions monitored by Cuckoo

How to determine Bulz.164936?


File Info:
name: 186D759E5D84A8178D3B.mlwpath: /opt/CAPEv2/storage/binaries/33779d50041c943e1550ae597b959c52ba73d7c53e10951b17af16e4cf8db8a2crc32: CB5597F8md5: 186d759e5d84a8178d3b7db7094f0e83sha1: c5a6e2fc68e7f403dae7a1571830681058a95298sha256: 33779d50041c943e1550ae597b959c52ba73d7c53e10951b17af16e4cf8db8a2sha512: 2afde121380327dde583123085b1fa93c50feb82d4be7a49db32ee3682c3b322020d9c1edca5569819bcc9caa5a4127f62c556b7a08f3ac9ba5bc83ab7d5df86ssdeep: 196608:5VSkB5nm3tyWCDzjVvlXuVzd05zc5L6RFwRzgVc:n/B1m3tyfB9+Vd05zcgFUctype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T17B8633B362751146F0D1CC79552B7DD231FB072A9B82AC78A9AA7DC539322A4F313D23sha3_384: 27c448e65dbdbab227d7daaa6d9f9b5a198fed62957a3d9c5196da62c031a01a43f15dae459f241723319c526ef7d7baep_bytes: 68f7ebac7fe858481f008dadfffffffftimestamp: 2020-09-25 19:10:40
Version Info:
Comments: This installation was built with Inno Setup.CompanyName: Actual Tools                                                FileDescription: Actual File Folders Setup                                   FileVersion: 1.14.2_en           LegalCopyright: 2002-2019, Actual Tools                                                                             ProductName: Actual File Folders                                         ProductVersion: 1.14.2                                            Translation: 0x0000 0x04b0

Bulz.164936 also known as:

Bkav	W32.AIDetect.malware2
Lionic	Riskware.Win32.DownloadAsist.1!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Bulz.164936
FireEye	Generic.mg.186d759e5d84a817
McAfee	GenericRXAA-FA!186D759E5D84
Cylance	Unsafe
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Trojan ( 005690671 )
K7GW	Trojan ( 005690671 )
Cybereason	malicious.e5d84a
Arcabit	Trojan.Bulz.D28448
BitDefenderTheta	Gen:NN.ZexaF.34062.@R0@aqOy5ski
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/DownloadAssistant.AD potentially unwanted
Paloalto	generic.ml
Kaspersky	Trojan.Win32.Ekstak.agpzm
BitDefender	Gen:Variant.Bulz.164936
NANO-Antivirus	Trojan.Win32.Ekstak.hxynqv
Avast	Win32:Malware-gen
Rising	Trojan.Generic@ML.99 (RDML:EX8eDZoOaEQKPK/4U1cQVw)
Ad-Aware	Gen:Variant.Bulz.164936
Sophos	Download Assistant (PUA)
VIPRE	Trojan.Win32.Generic!BT
McAfee-GW-Edition	BehavesLike.Win32.Generic.rc
SentinelOne	Static AI – Suspicious PE
Emsisoft	Gen:Variant.Bulz.164936 (B)
Ikarus	Trojan.Crypt
eGambit	Unsafe.AI_Score_81%
Avira	HEUR/AGEN.1139250
Microsoft	Trojan:Win32/Wacatac.A!ml
ViRobot	Adware.Bulz.8468480
GData	Gen:Variant.Bulz.164936
Cynet	Malicious (score: 100)
AhnLab-V3	PUP/Win32.DownloadAssistant.R352179
Acronis	suspicious
Malwarebytes	Adware.DownloadAssistant
APEX	Malicious
MAX	malware (ai score=87)
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	Riskware/Ekstak
AVG	Win32:Malware-gen
Panda	Trj/Genetic.gen