Categories: Malware

About “Heur.BZC.MTN.Boxter.1020.B4B97952” infection

The Heur.BZC.MTN.Boxter.1020.B4B97952 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Heur.BZC.MTN.Boxter.1020.B4B97952 virus can do?

A file was accessed within the Public folder.
A HTTP/S link was seen in a script or command line
The binary contains an unknown PE section name indicative of packing
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
A scripting utility was executed
Uses Windows utilities to create a scheduled task
Deletes executed files from disk
Attempts to execute suspicious powershell command arguments

How to determine Heur.BZC.MTN.Boxter.1020.B4B97952?


File Info:
name: AFC92B6B461A577F1E42.mlwpath: /opt/CAPEv2/storage/binaries/c7a4370fc2d4edef249c7f8c298df730641c3358fcdf113b3b4156922108bd2dcrc32: 94A081E2md5: afc92b6b461a577f1e42d734b9171d87sha1: 773c290a0602163e9e6d6a77f000039bedcc6de8sha256: c7a4370fc2d4edef249c7f8c298df730641c3358fcdf113b3b4156922108bd2dsha512: 76e967e889b3ded0ff4062eb1922b6e2f53b27d36f9078759f7fffebf17d269924a62905995b4f7850bc158a3d3fddfcf25cb2687c5471636d608ac86a9e4c85ssdeep: 3072:57DhdC6kzWypvaQ0FxyNTBfvb6OHDPjzU7:5BlkZvaF4NTBXXjzItype: PE32 executable (console) Intel 80386, for MS Windowstlsh: T116D37C03B3D101F6E7E3173108A6617AD737AE24976B9AD7C3883B0265325D2763A3E5sha3_384: a2e0c9e48df11d0406a713c4d2bad0850d126655db19d766555ab77e1a510fe46a15bd14bca4352b9746d94bb6aa85e5ep_bytes: 68ac00000068000000006868804100e8timestamp: 2019-07-30 08:52:45
Version Info:
FileVersion: 2.0.5.5ProductVersion: 2.0.5.5ProductName: GDOriginalFilename: GDInternalName: GDFileDescription: GDCompanyName: SamsungLegalTrademarks: Samsung™LegalCopyright: Samsung©PrivateBuild: 2.0.5.5SpecialBuild: 2.0.5.5Translation: 0x0000 0x04e4

Heur.BZC.MTN.Boxter.1020.B4B97952 also known as:

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Boxter.4!c
MicroWorld-eScan	Heur.BZC.MTN.Boxter.1020.B4B97952
FireEye	Generic.mg.afc92b6b461a577f
Skyhigh	BehavesLike.Win32.Generic.ch
McAfee	Artemis!AFC92B6B461A
Cylance	unsafe
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Riskware ( 00584baa1 )
K7GW	Riskware ( 00584baa1 )
Cybereason	malicious.b461a5
BitDefenderTheta	Gen:NN.ZexaF.36802.iu0@aW4bs6f
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ClamAV	Win.Trojan.Generic-10011119-0
Kaspersky	Trojan.Win32.Agent.xbmmls
BitDefender	Heur.BZC.MTN.Boxter.1020.B4B97952
Avast	FileRepMalware [Misc]
Emsisoft	Heur.BZC.MTN.Boxter.1020.B4B97952 (B)
F-Secure	Trojan.TR/AD.Nekark.dcwun
VIPRE	Heur.BZC.MTN.Boxter.1020.B4B97952
Sophos	Mal/Generic-S
Ikarus	Trojan.PowerShell.Rozena
Google	Detected
Avira	TR/AD.Nekark.dcwun
Kingsoft	malware.kb.a.729
Arcabit	Heur.BZC.MTN.Boxter.1020.B4B97952 [many]
ZoneAlarm	Trojan.Win32.Agent.xbmmls
GData	Heur.BZC.MTN.Boxter.1020.B4B97952
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win.Generic.C5005915
MAX	malware (ai score=84)
Malwarebytes	Generic.Malware/Suspicious
Rising	Trojan.Generic!8.C3 (CLOUD)
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.237618388.susgen
AVG	FileRepMalware [Misc]
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_70% (D)
alibabacloud	Trojan:Win/BZC.MNT