Categories: Malware

What is “Win32:Buzus-RB [Trj]”?

The Win32:Buzus-RB [Trj] is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32:Buzus-RB [Trj] virus can do?

Executable code extraction
Drops a binary and executes it
The binary likely contains encrypted or compressed data.
Detects Sandboxie through the presence of a library
Installs itself for autorun at Windows startup
Network activity detected but not expressed in API logs
Anomalous binary characteristics

How to determine Win32:Buzus-RB [Trj]?


File Info:
crc32: 7328DB26md5: 64e09f347853d2623b6b088acb5b4798name: 64E09F347853D2623B6B088ACB5B4798.mlwsha1: 8d7a5d4a970cd0c9567ec02d8a9aae362485befasha256: 1a27dae5b2e3ab9692a35d8196cb36056b96e81865b74a4b1272a78241b1979dsha512: 54eb40507657d1418c36d34ed195a3a76ad74fcc51849ee67693370f38d034404078b59ce468f98ef279bbe7b87656d5eba6d335bb42b1bbfa0faaa6cb05bb0essdeep: 6144:yj6wei2yCy5xKJbVCsI6JmqvKb3wUvtiCGK4yIDx6Grp8wRDsV2K:yKT3tVCsI6JiNvtiGIDx6GN0VBtype: PE32 executable (GUI) Intel 80386, for MS Windows
Version Info:
LegalCopyright: Copyright (C) 2007InternalName: Keygen.exeFileVersion: 1, 0, 0, 1CompanyName: PrivateBuild: LegalTrademarks: Comments: ProductName: Adobe FireWorks CS3 KeygenSpecialBuild: ProductVersion: 9, 1, 1, 0FileDescription: Adobe FireWorks CS3 KeygenOriginalFilename: Keygen.EXETranslation: 0x0409 0x04b0

Win32:Buzus-RB [Trj] also known as:

Lionic	Trojan.Win32.Chifrax.4!c
Elastic	malicious (high confidence)
DrWeb	Trojan.Siggen.304
Cynet	Malicious (score: 100)
CAT-QuickHeal	Trojan.Buzus.WT3
ALYac	Gen:Heur.Crifi.1
Cylance	Unsafe
Sangfor	Trojan.Win32.Chifrax.d
CrowdStrike	win/malicious_confidence_60% (D)
Cybereason	malicious.47853d
Cyren	W32/Chifrax!Generic
Symantec	Downloader
ESET-NOD32	multiple detections
APEX	Malicious
Avast	Win32:Buzus-RB [Trj]
Kaspersky	Trojan.Win32.Chifrax.d
BitDefender	Gen:Heur.Crifi.1
NANO-Antivirus	Trojan.Win32.Buzus.dxktth
MicroWorld-eScan	Gen:Heur.Crifi.1
Tencent	Win32.Trojan.Chifrax.Wqmy
Ad-Aware	Gen:Heur.Crifi.1
Sophos	Mal/Generic-R + Troj/BadCab-A
Comodo	TrojWare.Win32.Agent.~Wrar@1n6zi5
F-Secure	Trojan.TR/Dropper.Gen
BitDefenderTheta	AI:Packer.F70DBB2D23
VIPRE	Trojan.Win32.Chifrax.d (v)
McAfee-GW-Edition	BehavesLike.Win32.Dropper.fc
FireEye	Generic.mg.64e09f347853d262
Emsisoft	Gen:Heur.Crifi.1 (B)
SentinelOne	Static AI – Suspicious PE
Jiangmin	TrojanDropper.KGen.gaj
Webroot	Trojan:Win32/VB.ZO
Avira	TR/Dropper.Gen
Microsoft	Trojan:Win32/Occamy.C1A
Arcabit	Trojan.Crifi.1
ZoneAlarm	Trojan.Win32.Chifrax.d
GData	Gen:Heur.Crifi.1
AhnLab-V3	Trojan/Win32.Chifrax.C2573970
McAfee	Artemis!64E09F347853
MAX	malware (ai score=87)
VBA32	Malware-Cryptor.VB.gen.1
Malwarebytes	Generic.Malware/Suspicious
Panda	Trj/Chifrax.B
Rising	Trojan.Generic@ML.100 (RDML:PZniulG939eo10Nigw0oZQ)
Ikarus	Trojan.Buzus
MaxSecure	Trojan.Chifrax.D
Fortinet	W32/ModCab.A!tr
AVG	Win32:Buzus-RB [Trj]