Categories: Malware

What is “Win32/Packed.MultiPacked.BN”?

The Win32/Packed.MultiPacked.BN is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Packed.MultiPacked.BN virus can do?

Creates RWX memory
Reads data out of its own binary image
Drops a binary and executes it
Unconventionial binary language: Chinese (Simplified)
Unconventionial language used in binary resources: Chinese (Simplified)
The binary likely contains encrypted or compressed data.
The executable is compressed using UPX
Uses Windows utilities for basic functionality
Tries to suspend Cuckoo threads to prevent logging of malicious activity
Anomalous binary characteristics
Uses suspicious command line tools or Windows utilities

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine Win32/Packed.MultiPacked.BN?


File Info:
crc32: CC671B86md5: 099a123180cef5375e71e0d38eef7038name: ds20200224a_x86_16-34-32.exesha1: 46060ff65db447edc1c046b833d4adea7caadd92sha256: 6847c93b04f05c360d82d96649cf763d2164b7afed5290676f1c332a6db2c009sha512: 67e12d8239b4448c3c029284cb05161c3eb56e1533ae730a23944dbba3ef5a61c66643ef6b815eda5ab44269616079739f30800880e114cdc441e8b930e26419ssdeep: 49152:iRubdMhAMhqgQPbkD0rFgy9w3BJR1c+v4zA7b2RrbNWGN7zNgrSMd6A:ikxqAMhq6EA1c26A7b4rRjBzNrTtype: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Version Info:
LegalCopyright: Copyright (C) 2012-2020 www.54nb.com All Rights ReservedInternalName: x7f51x7edcx4ee3x7406x7a0bx5e8fFileVersion: 20200224aCompanyName: x6398x91d1x7f51ProductName: x6302x673ax5b9dProductVersion: 20200224aFileDescription: x6398x91d1x7f51 x901ax7528x7f51x7edcx4ee3x7406x7a0bx5e8fOriginalFilename: Loader.exeTranslation: 0x0804 0x04b0

Win32/Packed.MultiPacked.BN also known as:

MicroWorld-eScan	Trojan.GenericKD.33557994
Qihoo-360	Win32/Trojan.Hacktool.0e0
McAfee	Artemis!099A123180CE
Cylance	Unsafe
AegisLab	Hacktool.Win32.Gamehack.3!c
K7AntiVirus	Trojan ( 0053f9601 )
BitDefender	Trojan.GenericKD.33557994
K7GW	Trojan ( 0053f9601 )
Cybereason	malicious.65db44
BitDefenderTheta	Gen:NN.ZelphiF.34100.Hoxaa4ny8Dhb
Cyren	W32/Trojan.UUNL-0881
ESET-NOD32	a variant of Win32/Packed.MultiPacked.BN
TrendMicro-HouseCall	TROJ_GEN.R002H09CK20
GData	Trojan.GenericKD.33557994
Kaspersky	HackTool.Win32.Gamehack.bvik
Alibaba	HackTool:Win32/MultiPacked.bfa3a3f6
Rising	Trojan.Occamy!8.F1CD (CLOUD)
Endgame	malicious (moderate confidence)
Sophos	Generic PUA EG (PUA)
Comodo	Malware@#3bi1vbce4e35l
Zillya	Tool.Morto.Win32.1
Invincea	heuristic
McAfee-GW-Edition	BehavesLike.Win32.Dropper.vc
Trapmine	malicious.high.ml.score
Emsisoft	Trojan.GenericKD.33557994 (B)
APEX	Malicious
Microsoft	Trojan:Win32/Occamy.C
Arcabit	Trojan.Generic.D2000DEA
ZoneAlarm	HackTool.Win32.Gamehack.bvik
VBA32	TScope.Trojan.Delf
ALYac	Trojan.GenericKD.33557994
MAX	malware (ai score=86)
Ad-Aware	Trojan.GenericKD.33557994
Tencent	Win32.Hacktool.Gamehack.Gvq
eGambit	Unsafe.AI_Score_98%
Fortinet	Riskware/Gamehack.BVIK!tr
Paloalto	generic.ml
CrowdStrike	win/malicious_confidence_60% (W)