Categories: Malware

What is “Bulz.42402”?

The Bulz.42402 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Bulz.42402 virus can do?

Behavioural detection: Executable code extraction – unpacking
CAPE extracted potentially suspicious content
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
CAPE detected the embedded win api malware family
Anomalous binary characteristics
Yara detections observed in process dumps, payloads or dropped files

How to determine Bulz.42402?


File Info:
name: 48F55B347E25A7C8F460.mlwpath: /opt/CAPEv2/storage/binaries/5d0035a1cea7c5a8c61e7083f14380b1ba37c276980c5f80f845d5c523c2d7bbcrc32: E37B4CBBmd5: 48f55b347e25a7c8f46099e68be378casha1: 1999bc51902d15939f9b52e57d842b0135c27575sha256: 5d0035a1cea7c5a8c61e7083f14380b1ba37c276980c5f80f845d5c523c2d7bbsha512: d2dfdff111321c96f1b1bd578b2740c8923296ef8c7eeef58199f4d2bb240ff82f25104466a6067e948108643cdaf81f24b76f92ff4c0d922a23c298d5b04182ssdeep: 3072:uAJPSHm8gn5nXTBfcFbKI5pkjBDxeqo3eUIL:uOSHm8gnhTB0FbhmD8q1Dtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1E604BE00B5C0C2B3D4B7113544EACB758A3978720B6E95D7FB9E2BB65E212E097352CEsha3_384: a52f43c1c1befaf52cbf7077bc5ce7cd8a2fa2ff0f49d7db3b3d4ddcb864f637a02b09e057dbe1a52025863d163c69aeep_bytes: e8dd5b0000e9a4feffff6a0c68c81342timestamp: 2009-09-20 11:43:57
Version Info:
Translation: 0x0000 0x04b0CompanyName: MicrosoftFileDescription: syncuiFileVersion: 1.0.0.0InternalName: syncui.exeLegalCopyright: Copyright © Microsoft 2010OriginalFilename: syncui.exeProductName: syncuiProductVersion: 1.0.0.0Assembly Version: 1.0.0.0

Bulz.42402 also known as:

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Agent.a!c
AVG	FileRepMalware [Trj]
Elastic	malicious (high confidence)
DrWeb	Trojan.DownLoad3.16845
MicroWorld-eScan	Gen:Variant.Bulz.42402
FireEye	Generic.mg.48f55b347e25a7c8
CAT-QuickHeal	Backdoor.Bladabindi.S1958953
Skyhigh	BehavesLike.Win32.Redline.cc
McAfee	Generic BackDoor.aam
Zillya	Downloader.Agent.Win32.111981
Sangfor	Trojan.Win32.Generic.ky
Alibaba	Trojan:MSIL/Injector.d155f233
Cybereason	malicious.47e25a
BitDefenderTheta	Gen:NN.ZexaF.36802.lq0@aShMVYi
VirIT	Trojan.Win32.Generic.MTO
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/Injector.HE
Cynet	Malicious (score: 100)
APEX	Malicious
ClamAV	Win.Malware.Score-6912404-0
Kaspersky	HEUR:Trojan.Win32.Generic
BitDefender	Gen:Variant.Bulz.42402
SUPERAntiSpyware	Trojan.Agent/Gen-Mdrop
Avast	FileRepMalware [Trj]
Tencent	Win32.Trojan.Generic.Iajl
Emsisoft	Gen:Variant.Bulz.42402 (B)
VIPRE	Gen:Variant.Bulz.42402
Trapmine	malicious.high.ml.score
Sophos	Mal/Mdrop-BK
SentinelOne	Static AI – Malicious PE
Webroot	Rootkit.Gen
MAX	malware (ai score=99)
Kingsoft	malware.kb.a.983
Microsoft	Trojan:Win32/Orsam!rts
Xcitium	Malware@#3j996kita6tdr
Arcabit	Trojan.Bulz.DA5A2
ViRobot	Worm.Win32.Autorun.284737
ZoneAlarm	HEUR:Trojan.Win32.Generic
GData	Gen:Variant.Bulz.42402
Google	Detected
AhnLab-V3	Downloader/Win32.Agent.C100885
VBA32	Trojan-Inject.Memtest
ALYac	Gen:Variant.Bulz.42402
Cylance	unsafe
Panda	Generic Malware
Rising	Trojan.Generic@AI.97 (RDML:SCD6q3nqz8LtHaD/B3GEtA)
Ikarus	Trojan.Win32.Jorik
MaxSecure	Trojan-Downloader.Agent.EDBQ
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_90% (D)
alibabacloud	Trojan:MSIL/Bulz