Should I remove “Application.Bulz.372419”?

The Application.Bulz.372419 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Application.Bulz.372419 virus can do?

• Behavioural detection: Executable code extraction – unpacking
• SetUnhandledExceptionFilter detected (possible anti-debug)
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• NtSetInformationThread: attempt to hide thread from debugger
• Possible date expiration check, exits too soon after checking local time
• Guard pages use detected – possible anti-debugging.
• Dynamic (imported) function loading detected
• Enumerates the modules from a process (may be used to locate base addresses in process injection)
• Enumerates running processes
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Checks for the presence of known windows from debuggers and forensic tools
• CAPE detected the OrcusRAT malware family
• Checks for the presence of known devices from debuggers and forensic tools
• Detects Bochs through the presence of a registry key
• Harvests cookies for information gathering
• Anomalous binary characteristics

How to determine Application.Bulz.372419?

File Info:
name: AEF75E1C09B24025689D.mlw
path: /opt/CAPEv2/storage/binaries/6d987aa076e1bd586a88520bded4a8e273662c3527efe76a694d3dd0d3c3851b
crc32: D7175171
md5: aef75e1c09b24025689d403fa2640094
sha1: 769b2d6b93955218221b07ad15760103d9107aa7
sha256: 6d987aa076e1bd586a88520bded4a8e273662c3527efe76a694d3dd0d3c3851b
sha512: 21d12916cbf3c6637837ff333ae13ca7ad6dc848fd71b4a49c6b23843a1d515066473cf4d4354a24f9246d043da9d4354ca4105f821db27c38d342a27cb18438
ssdeep: 49152:zf+RQhR70BbyO8CnRMu1sPmRDo+sT93IH:LYkRYBeOjR5sqsC
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1B49533F14180A134E98EC5B37F89930ED6B72F08D6956A0D2B1857D7C307EA5EAC428F
sha3_384: 1c9ede8ad057a00e1139a1b211418457d793097ba5211f5771459b1ae43362c3505d346deef1f72620979245eb722896
ep_bytes: eb0800120d000000000060e800000000
timestamp: 2022-02-02 13:33:16

Version Info:
Translation: 0x0000 0x04b0
Comments: 
CompanyName: 
FileDescription: 
FileVersion: 1.0.0.0
InternalName: Orcus.exe
LegalCopyright: 
LegalTrademarks: 
OriginalFilename: Orcus.exe
ProductName: 
ProductVersion: 1.0.0.0
Assembly Version: 1.0.0.0

Application.Bulz.372419 also known as:

How to remove Application.Bulz.372419?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.