Bulz.3242 (file analysis)

The Bulz.3242 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Bulz.3242 virus can do?

Creates RWX memory
A process created a hidden window
Uses Windows utilities for basic functionality
Anomalous binary characteristics

How to determine Bulz.3242?


File Info:
crc32: AB10A0CA
md5: a672795bd94f8179275ce522aa66bd75
name: A672795BD94F8179275CE522AA66BD75.mlw
sha1: b3edfa834f9add8cf00ca3ad569778641a050648
sha256: 897f374bfddfc8bea799b5e24d9b96ed445af84eb2b7705a44c5b6f5cfa2bd4b
sha512: 126358bf1993faef76a8eae9f9a94514526a205a352adc2e8401919d0f0897cdc4a2850618a89f44dc5b7f0a3614823a24334775dd32b311d3be5074f3bc3208
ssdeep: 192:ZYBc0L/ynZCndHWoI+ETL/cDJ61q4lz9yo0ytnpPIo0IGfyz4Qpkn4pnju4jpWB:ZYiCynZCnObfsYlzKKn/0Xfyze+niFC
type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

Version Info:
Translation: 0x0000 0x04b0
LegalCopyright: Copyright xa9  2018
Assembly Version: 1.0.0.0
InternalName: Epatage.exe
FileVersion: 1.0.0.0
CompanyName: 
LegalTrademarks: 
Comments: 
ProductName: Epatage
ProductVersion: 1.0.0.0
FileDescription: Epatage
OriginalFilename: Epatage.exe

Bulz.3242 also known as:

K7AntiVirus	Trojan ( 004d3df31 )
DrWeb	Trojan.PWS.Steam.15645
Cynet	Malicious (score: 99)
ALYac	Gen:Variant.Bulz.3242
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (W)
Alibaba	Trojan:MSIL/Filecoder.2e2df807
K7GW	Trojan ( 004d3df31 )
Cybereason	malicious.bd94f8
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/Filecoder.AC
APEX	Malicious
Avast	Win32:Rootkit-gen [Rtk]
Kaspersky	HEUR:Trojan-Ransom.MSIL.Generic
BitDefender	Gen:Variant.Bulz.3242
NANO-Antivirus	Trojan.Win32.Ransom.hoyqly
MicroWorld-eScan	Gen:Variant.Bulz.3242
Tencent	Msil.Trojan.Generic.Lmkg
Ad-Aware	Gen:Variant.Bulz.3242
Sophos	Mal/Generic-S
Comodo	Malware@#21yg8mvn0remt
BitDefenderTheta	Gen:NN.ZemsilF.34670.bm0@aOARr2b
McAfee-GW-Edition	Artemis!Trojan
FireEye	Generic.mg.a672795bd94f8179
Emsisoft	Gen:Variant.Bulz.3242 (B)
SentinelOne	Static AI – Malicious PE
Jiangmin	Trojan.MSIL.pyqg
Webroot	W32.Trojan.MSIL
Avira	HEUR/AGEN.1115170
eGambit	Unsafe.AI_Score_99%
Microsoft	Trojan:Win32/AgentTesla!ml
AegisLab	Trojan.MSIL.Generic.j!c
GData	Gen:Variant.Bulz.3242
AhnLab-V3	Trojan/Win32.RL_Generic.C3997092
McAfee	Artemis!A672795BD94F
MAX	malware (ai score=82)
VBA32	TScope.Trojan.MSIL
Panda	Trj/GdSda.A
Rising	Ransom.Generic!8.E315 (CLOUD)
Yandex	Trojan.Filecoder!5Yt1OSk0iwQ
Ikarus	Trojan-Ransom.FileCrypter
Fortinet	MSIL/Filecoder.AC!tr
AVG	Win32:Rootkit-gen [Rtk]
Paloalto	generic.ml
Qihoo-360	Win32/Rootkit.Generic.HgIASOcA

How to remove Bulz.3242?

Bulz.3242 removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X