Categories: Malware

How to remove “Bulz.226944”?

The Bulz.226944 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Bulz.226944 virus can do?

SetUnhandledExceptionFilter detected (possible anti-debug)
At least one process apparently crashed during execution
Yara rule detections observed from a process memory dump/dropped files/CAPE
Creates RWX memory
NtSetInformationThread: attempt to hide thread from debugger
Guard pages use detected – possible anti-debugging.
Dynamic (imported) function loading detected
Enumerates running processes
Expresses interest in specific running processes
Repeatedly searches for a not-found process, may want to run with startbrowser=1 option
Unconventionial language used in binary resources: Russian
Authenticode signature is invalid
Detects VirtualBox through the presence of a library
Detects Sandboxie through the presence of a library
Checks the presence of disk drives in the registry, possibly for anti-virtualization
Detects VirtualBox through the presence of a device
Detects VirtualBox through the presence of a file

How to determine Bulz.226944?


File Info:
name: 26F29DED53271AFB4C5F.mlwpath: /opt/CAPEv2/storage/binaries/889aabb478b15e82d54a1139ea2d425d1845f5184c11dcf90ae1d32a02a12810crc32: AA605E87md5: 26f29ded53271afb4c5f58133e58de58sha1: 9236b43142f56715681f67f113fef8eba4058cedsha256: 889aabb478b15e82d54a1139ea2d425d1845f5184c11dcf90ae1d32a02a12810sha512: 9e976414eb4096ac03ae20d050997e892970a201ee193d3d7142f93dc76f9880cac83e77d5317f27e7a97e922ac234635b7f9b6f4fb055caebfed34e0388121assdeep: 24576:1JdEI9mejJ93mrSuHKvYj3qhexkakk+iqDEl340Yyc06y:1JdEI9melcdqE3WexkR1DEl340nltype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T19545AF01F6017936E9A60430DDBAE37A8A287E30171545DBB7C81DDBEB790D0AA7533Bsha3_384: 0e069fc0923a94fce6eb36b7844bdd90638efd446da1b609608e40b8ff3d409a4b8549ffb76bdacc4a37c73ddf5a3271ep_bytes: e8e7060000e97afeffff558bec5de959timestamp: 2020-11-15 20:47:11
Version Info:
0: [No Data]

Bulz.226944 also known as:

Lionic	Trojan.Win32.Generic.4!c
MicroWorld-eScan	Gen:Variant.Bulz.226944
FireEye	Generic.mg.26f29ded53271afb
ALYac	Gen:Variant.Bulz.226944
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
Sangfor	Trojan.Win32.Wacatac.D8
Arcabit	Trojan.Bulz.D37680
BitDefenderTheta	Gen:NN.ZexaE.34212.mvW@aORf7kek
Symantec	ML.Attribute.HighConfidence
Paloalto	generic.ml
BitDefender	Gen:Variant.Bulz.226944
Ad-Aware	Gen:Variant.Bulz.226944
Sophos	Generic ML PUA (PUA)
McAfee-GW-Edition	BehavesLike.Win32.Generic.th
Emsisoft	Gen:Variant.Bulz.226944 (B)
SentinelOne	Static AI – Malicious PE
Jiangmin	Heur:Trojan/AntiVM
Microsoft	Trojan:Win32/Zpevdo.B
GData	Gen:Variant.Bulz.226944
McAfee	Artemis!26F29DED5327
MAX	malware (ai score=84)
VBA32	BScope.Adware.SpeedBit
APEX	Malicious
MaxSecure	Trojan.Malware.110073591.susgen
Cybereason	malicious.d53271