Bulz.267394 (file analysis)

The Bulz.267394 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Bulz.267394 virus can do?

Executable code extraction
Attempts to connect to a dead IP:Port (1 unique times)
Creates RWX memory
Performs some HTTP requests
Unconventionial language used in binary resources: Norwegian (Nynorsk)
The binary likely contains encrypted or compressed data.
Attempts to identify installed AV products by installation directory
Checks the CPU name from registry, possibly for anti-virtualization
Anomalous binary characteristics

Related domains:

iplogger.org

skincrawling.top

How to determine Bulz.267394?


File Info:
crc32: 98AB3937
md5: 7dfcfc4db04043b83c082561a945a372
name: 7DFCFC4DB04043B83C082561A945A372.mlw
sha1: b3c6a4b2629f3ff9525fea81d50bd6362a497efa
sha256: c86ceb78c8aa8ecb5e96f7d44a8c593ef2c310102189366d4c0d35e80c0115c9
sha512: f0a7b29215a75503040962432a3c65542f81bcc8af08e47d476acd9074daa49e053636b9e72268fe40457e83c561537f795702efab7ab5b7090d94aadfb74eb6
ssdeep: 12288:372sKOTeZQ4rRqs85ejmpdissv/afsONiFQ6b4oOumIqTwyv:372bOTeZQCDMdise/afgnOumIqUyv
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
InternalName: triwylbifes.acs
FileVers: 26.26.361
ProductionVersion: 1.0.22.25
Copyright: Copyrighz (C) 2020, pagkafug
TranslationUsa: 0x0772 0x0089

Bulz.267394 also known as:

Bkav	W32.AIDetectVM.malware1
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Bulz.267394
FireEye	Generic.mg.7dfcfc4db04043b8
Qihoo-360	HEUR/QVM10.1.ECDF.Malware.Gen
Cylance	Unsafe
Sangfor	Malware
BitDefender	Gen:Variant.Bulz.267394
K7GW	Hacktool ( 700007861 )
Cybereason	malicious.2629f3
Cyren	W32/Kryptik.CRY.gen!Eldorado
Symantec	Packed.Generic.525
APEX	Malicious
Avast	Win32:PWSX-gen [Trj]
ClamAV	Win.Malware.Faff-9806499-0
Kaspersky	UDS:DangerousObject.Multi.Generic
Rising	Trojan.Kryptik!1.CFEE (CLASSIC)
Ad-Aware	Gen:Variant.Bulz.267394
Emsisoft	Gen:Variant.Bulz.267394 (B)
McAfee-GW-Edition	BehavesLike.Win32.Generic.tm
Sophos	ML/PE-A
Ikarus	Trojan.Win32.Crypt
Microsoft	Trojan:Win32/Glupteba.NK!MTB
Gridinsoft	Trojan.Heur!.02816021
ZoneAlarm	UDS:DangerousObject.Multi.Generic
GData	Win32.Trojan.AutoHotkey.SMQDAB
Cynet	Malicious (score: 100)
Acronis	suspicious
McAfee	Artemis!7DFCFC4DB040
MAX	malware (ai score=82)
Malwarebytes	Trojan.MalPack.GS
ESET-NOD32	a variant of Win32/Kryptik.HIFB
SentinelOne	Static AI – Malicious PE
Fortinet	W32/Kryptik.HHJI!tr
AVG	Win32:PWSX-gen [Trj]
CrowdStrike	win/malicious_confidence_100% (D)
MaxSecure	Trojan.Malware.300983.susgen

How to remove Bulz.267394?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Bulz.267394 (file analysis)