Categories: Malware

About “Bulz.284902” infection

The Bulz.284902 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Bulz.284902 virus can do?

Injection (inter-process)
Injection (Process Hollowing)
Creates RWX memory
Reads data out of its own binary image
Drops a binary and executes it
Executed a process and injected code into it, probably while unpacking
Sniffs keystrokes
Interacts with known DarkComet registry keys
Creates known Fynloski/DarkComet mutexes

Related domains:

0.tcp.ngrok.io

How to determine Bulz.284902?


File Info:
crc32: E08C3C50md5: a7c4b880ca2a4e975890199e06b439ccname: A7C4B880CA2A4E975890199E06B439CC.mlwsha1: 12f7d72ba4fa4e1f496856441b53ede33f1e3809sha256: 5cd8924328a7410215c895cd0de484846df13d583e15650ded75ba62b88c17d0sha512: d1be9c477973172c64d7d7238e95c3d3a86e5aa354262207d40114419620df4bcc34c62e70a9da90d547a93f4e9ce1978a269af887dbf64685b76459d17b571fssdeep: 12288:wRZ+IoG/n9IQxW3OBseWJcZiabpbQfFgVmf+7WDU07/wbWtA2LB5YnWp/A:q2G/nvxW3WwWi81QtgVmSL08WrP0WKtype: PE32 executable (GUI) Intel 80386, for MS Windows
Version Info:
0: [No Data]

Bulz.284902 also known as:

Bkav	W32.AIDetect.malware2
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Bulz.284902
FireEye	Generic.mg.a7c4b880ca2a4e97
CAT-QuickHeal	Trojan.Wacatac
ALYac	Gen:Variant.Bulz.284902
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_70% (W)
BitDefender	Gen:Variant.Bulz.284902
K7GW	Riskware ( 0040eff71 )
K7AntiVirus	Riskware ( 0040eff71 )
Cyren	W32/Darkkomet.A.gen!Eldorado
Symantec	Backdoor.Graybird
APEX	Malicious
Avast	Win32:Agent-AWZS [Trj]
Kaspersky	Backdoor.Win32.DarkKomet.aagt
Alibaba	Backdoor:Win32/DarkKomet.37dbb780
NANO-Antivirus	Trojan.Win32.DarkKomet.ecawjb
Ad-Aware	Gen:Variant.Bulz.284902
Emsisoft	Gen:Variant.Bulz.284902 (B)
Comodo	TrojWare.Win32.Fynloski.B@57zt85
F-Secure	Heuristic.HEUR/AGEN.1136694
DrWeb	BackDoor.Tordev.976
TrendMicro	TROJ_GEN.R002C0DBS21
McAfee-GW-Edition	BehavesLike.Win32.Dropper.jh
Sophos	Mal/Generic-S
SentinelOne	Static AI – Suspicious PE
Avira	HEUR/AGEN.1136694
Antiy-AVL	Trojan[Backdoor]/Win32.DarkKomet.xyk
Kingsoft	Win32.Hack.Undef.(kcloud)
Microsoft	Backdoor:Win32/Fynloski
Arcabit	Trojan.Bulz.D458E6
ZoneAlarm	Backdoor.Win32.DarkKomet.aagt
GData	Gen:Variant.Bulz.284902
Cynet	Malicious (score: 100)
McAfee	Artemis!A7C4B880CA2A
MAX	malware (ai score=85)
VBA32	Backdoor.Tordev
Malwarebytes	Generic.Worm.Autorun.DDS
Panda	Trj/CI.A
Zoner	Trojan.Win32.29392
ESET-NOD32	multiple detections
TrendMicro-HouseCall	TROJ_GEN.R002C0DBS21
Tencent	Win32.Backdoor.Darkkomet.Lork
Ikarus	Backdoor.Win32.DarkKomet
Fortinet	W32/multiple_detections
BitDefenderTheta	Gen:NN.ZexaF.34590.PyZ@aai7@FdO
AVG	Win32:Agent-AWZS [Trj]
Cybereason	malicious.0ca2a4
Paloalto	generic.ml
Qihoo-360	Win32/Backdoor.DarkKomet.HgIASPkA