Malware

Bulz.655215 (file analysis)

Malware Removal

The Bulz.655215 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Bulz.655215 virus can do?

  • Behavioural detection: Executable code extraction – unpacking
  • At least one process apparently crashed during execution
  • Yara rule detections observed from a process memory dump/dropped files/CAPE
  • Creates RWX memory
  • Dynamic (imported) function loading detected
  • CAPE extracted potentially suspicious content
  • Authenticode signature is invalid

How to determine Bulz.655215?



File Info:

name: 8993CA9025DF7CDFEE64.mlw
path: /opt/CAPEv2/storage/binaries/07f726f72e8ce44a69de17da2822ad4cba08e29e64c644f3f62954cfeb8b96d1
crc32: 10C10F44
md5: 8993ca9025df7cdfee64edc454377def
sha1: a55f891277455923c4e65063b37d01b3cd1c27d4
sha256: 07f726f72e8ce44a69de17da2822ad4cba08e29e64c644f3f62954cfeb8b96d1
sha512: 638291c48aab1581a079b333f4fd6e9fdacff9cd17f663c20376531494a1b604ab4a8e913eeba8d1761112cf89f6f390b696e38ae318e1d2c5d82af23f678b45
ssdeep: 1536:fDT8vLrQ9Y2YBrAGTBGhLJk2/fBAMIOafDoD+:rA4YBAgGh3BAMIOq
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T110A37DE2E664D440E1148EB2D43687F24338EF73D85A9FDB29247E2D3578593D0E4A4E
sha3_384: 80fee1f822e10bfd265a70ff657e8c352f9ceb34e2aa28d0b0913365d61ded0d1b7fe81a0527d33b331aee5cf87e285c
ep_bytes: 6874144000e8f0ffffff000000000000
timestamp: 2021-08-27 03:09:12


Version Info:

Translation: 0x0000 0x04b0
Comments: ClassMate
CompanyName: ClassMate
ProductName: ClassMate
FileVersion: 1.00
ProductVersion: 1.00
InternalName: Kasterens
OriginalFilename: Kasterens.exe

Bulz.655215 also known as:

BkavW32.AIDetect.malware2
LionicTrojan.MSIL.NanoBot.m!c
Elasticmalicious (high confidence)
ClamAVWin.Packed.Guloader-9897535-0
FireEyeGeneric.mg.8993ca9025df7cdf
McAfeeGuLoader-FDCP!8993CA9025DF
CylanceUnsafe
SangforBackdoor.MSIL.NanoBot.besg
K7AntiVirusTrojan ( 005818811 )
AlibabaBackdoor:MSIL/NanoBot.89119463
K7GWTrojan ( 005818811 )
CrowdStrikewin/malicious_confidence_100% (W)
CyrenW32/Trojan.TINC-1204
SymantecPacked.Generic.575
ESET-NOD32a variant of Win32/GenKryptik.FJMX
APEXMalicious
Paloaltogeneric.ml
CynetMalicious (score: 100)
KasperskyBackdoor.MSIL.NanoBot.besg
BitDefenderGen:Variant.Bulz.655215
MicroWorld-eScanGen:Variant.Bulz.655215
AvastWin32:Trojan-gen
TencentMsil.Backdoor.Nanobot.Eckh
Ad-AwareGen:Variant.Bulz.655215
EmsisoftGen:Variant.Bulz.655215 (B)
DrWebTrojan.Inject4.15886
VIPRETrojan.Win32.Generic!BT
TrendMicroTROJ_GEN.R011C0PIJ21
McAfee-GW-EditionBehavesLike.Win32.Trojan.nh
SophosMal/Generic-S
SentinelOneStatic AI – Malicious PE
GDataGen:Variant.Bulz.655215
JiangminBackdoor.MSIL.eysw
MaxSecureTrojan.Malware.300983.susgen
AviraTR/Kryptik.orgtl
MAXmalware (ai score=88)
Antiy-AVLTrojan[Backdoor]/MSIL.NanoBot
ArcabitTrojan.Bulz.D9FF6F
ZoneAlarmBackdoor.MSIL.NanoBot.besg
MicrosoftTrojan:Win32/Sabsik.FL.B!ml
AhnLab-V3Trojan/Win.Generic.C4659710
BitDefenderThetaGen:NN.ZevbaF.34212.gm0@aOJ7r4g
ALYacGen:Variant.Bulz.655215
VBA32BScope.Trojan.Mucc
MalwarebytesTrojan.GuLoader
TrendMicro-HouseCallTROJ_GEN.R011C0PIJ21
RisingBackdoor.NanoBot!8.28C (CLOUD)
YandexTrojan.AvsArher.bTx33N
IkarusTrojan.VB.Crypt
eGambitUnsafe.AI_Score_74%
FortinetW32/GenKryptik.FJMX!tr
WebrootW32.Trojan.Gen
AVGWin32:Trojan-gen
PandaTrj/GdSda.A

How to remove Bulz.655215?

Bulz.655215 removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment