Categories: Malware

About “Kazy.429418” infection

The Kazy.429418 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Kazy.429418 virus can do?

SetUnhandledExceptionFilter detected (possible anti-debug)
Creates RWX memory
Guard pages use detected – possible anti-debugging.
Dynamic (imported) function loading detected
Enumerates the modules from a process (may be used to locate base addresses in process injection)
CAPE extracted potentially suspicious content
Authenticode signature is invalid
Anomalous .NET characteristics

How to determine Kazy.429418?


File Info:
name: C8849F782EA3ECB48450.mlwpath: /opt/CAPEv2/storage/binaries/29778a5681062b1b5fcdc1fb18f091b0af3c2d3920d55f953c75aed0d2390764crc32: 6046C238md5: c8849f782ea3ecb484504e6b7ffe219dsha1: c38f3b9866bef4849b9e5bff60e4b62c9ab3facdsha256: 29778a5681062b1b5fcdc1fb18f091b0af3c2d3920d55f953c75aed0d2390764sha512: e52138be8e48720f13f1cf03658eddd24994e2093b4762542f9bb3e97fd7f9fd11ab1cb7ad722bda063f6a0d952bd34dce30f4f4479584994cfbba304c99ff0assdeep: 1536:S9BOd3EO6xu5Vxq643peBDNzuyxNZ9lkhCgFiZ6seHfr0pgKhY0:uBOSRYN43E6yx7ATsGrrKtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T17C93088DB7679C5DC3AC5B7BC487604C41B78567D122E22FAADA0DAC1E226C9C4CFE50sha3_384: f736918aba811c2593af90e8157fc7d7eb5e2ab28323a861d4cb5fd31bc5f1578c4ab280af570bcd651512b526f4febcep_bytes: ff250020400000000000000000000000timestamp: 2021-11-26 14:08:28
Version Info:
0: [No Data]

Kazy.429418 also known as:

Lionic	Trojan.Win32.Generic.4!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Kazy.429418
FireEye	Generic.mg.c8849f782ea3ecb4
ALYac	Gen:Variant.Kazy.429418
Cylance	Unsafe
K7AntiVirus	Trojan ( 700000121 )
Alibaba	Backdoor:MSIL/Bladabindi.321bd64b
K7GW	Trojan ( 700000121 )
CrowdStrike	win/malicious_confidence_100% (W)
BitDefenderTheta	Gen:NN.ZemsilF.34294.fmW@aWmdU5f
Cyren	W32/MSIL_Bladabindi.C.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/Bladabindi.BG
Baidu	MSIL.Backdoor.Bladabindi.a
TrendMicro-HouseCall	TROJ_GEN.R002C0DKQ21
Paloalto	generic.ml
ClamAV	Win.Packed.Bladabindi-6917466-0
Kaspersky	HEUR:Trojan.Win32.Generic
BitDefender	Gen:Variant.Kazy.429418
Avast	MSIL:GenMalicious-EA [Trj]
Rising	Backdoor.Njrat!1.9E49 (CLASSIC)
Ad-Aware	Gen:Variant.Kazy.429418
Emsisoft	Gen:Variant.Kazy.429418 (B)
Comodo	TrojWare.MSIL.Bladabindi.BGS@7lngf6
DrWeb	BackDoor.BladabindiNET.19
TrendMicro	TROJ_GEN.R002C0DKQ21
McAfee-GW-Edition	BehavesLike.Win32.Generic.nm
Sophos	ML/PE-A + Troj/Bbindi-W
Ikarus	Trojan.MSIL2
GData	Gen:Variant.Kazy.429418
Jiangmin	TrojanDropper.Autoit.dce
eGambit	Unsafe.AI_Score_100%
Avira	TR/Dropper.Gen7
MAX	malware (ai score=87)
Gridinsoft	Ransom.Win32.Bladabindi.sa
ViRobot	Trojan.Win32.Z.Bladabindi.97280.MS
APEX	Malicious
Microsoft	Backdoor:MSIL/Bladabindi.AL
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Bladabindi.C231440
Acronis	suspicious
McAfee	BackDoor-FDNN!C8849F782EA3
Malwarebytes	Backdoor.Bladabindi
Tencent	Win32.Trojan.Generic.Szlc
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	MSIL/Bladabindi.BG!tr
AVG	MSIL:GenMalicious-EA [Trj]
Cybereason	malicious.82ea3e
Panda	Trj/GdSda.A