Bulz.289162 malicious file

The Bulz.289162 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Bulz.289162 virus can do?

Executable code extraction
Creates RWX memory
A process attempted to delay the analysis task.
Expresses interest in specific running processes
A process created a hidden window
Drops a binary and executes it
HTTP traffic contains suspicious features which may be indicative of malware related traffic
Performs some HTTP requests
Unconventionial language used in binary resources: Norwegian (Nynorsk)
The binary likely contains encrypted or compressed data.
The executable is compressed using UPX
Uses Windows utilities for basic functionality
Deletes its original binary from disk
Installs itself for autorun at Windows startup
Contacts C&C server HTTP check-in (Banking Trojan)
Attempts to modify proxy settings
Creates a copy of itself
Anomalous binary characteristics

Related domains:

z.whorecord.xyz

a.tomx.xyz

gxd3fp7fe7cac6jzn2sac.online

How to determine Bulz.289162?


File Info:
crc32: 106BA53A
md5: fae1614105abb7aacf2da03b5402a5e1
name: FAE1614105ABB7AACF2DA03B5402A5E1.mlw
sha1: f7914176468da3346da61b8c3ebe530cb4bf62b6
sha256: 5df066693269e6e5cbe30e08a066e4934a4e1d3fd8cc900587326f248aa52a1d
sha512: b992bbb1b805d61af4db3abb635b85ea5a41858dbeb4ddc5e027130873ddfd46d0ec3ab216c356323efad66fc27c277ad8a07f107a5dc328446ccb660955b78b
ssdeep: 6144:zBpsV89zFh9okb20/2WlRAuhyddFqaGv3aAG/TqQnzzsmZ9KZWoV:46zFIkb22lRlhy7Ftg3aACWjmZ9KZW
type: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed

Version Info:
InternalName: triwilbifog.acs
FileVersion: 6.26.361
Copyright: Copyrighz (C) 2020, vodkafug
ProductVersion: 1.0.2
TranslationUsa: 0x0273 0x04d3

Bulz.289162 also known as:

Elastic	malicious (high confidence)
FireEye	Generic.mg.fae1614105abb7aa
McAfee	Artemis!FAE1614105AB
Cylance	Unsafe
Sangfor	Malware
K7AntiVirus	Riskware ( 0040eff71 )
BitDefender	Gen:Variant.Bulz.289162
K7GW	Riskware ( 0040eff71 )
Cybereason	malicious.6468da
Cyren	W32/Kryptik.CUR.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
TrendMicro-HouseCall	TROJ_GEN.R002H0CLV20
Paloalto	generic.ml
Cynet	Malicious (score: 100)
Kaspersky	Trojan-Spy.Win32.SpyEyes.blcw
Alibaba	TrojanSpy:Win32/SpyEyes.b44ba1cc
AegisLab	Trojan.Multi.Generic.4!c
MicroWorld-eScan	Gen:Variant.Bulz.289162
Avast	Win32:DropperX-gen [Drp]
Ad-Aware	Gen:Variant.Bulz.289162
Sophos	Mal/Generic-S
F-Secure	Trojan.TR/AD.TriumphLoader.xdwey
McAfee-GW-Edition	BehavesLike.Win32.Trojan.gc
Emsisoft	Gen:Variant.Bulz.289162 (B)
SentinelOne	Static AI – Malicious PE
Avira	TR/AD.TriumphLoader.xdwey
MAX	malware (ai score=86)
Microsoft	Trojan:Win32/Glupteba.NV!MTB
Gridinsoft	Trojan.Win32.Packed.oa
Arcabit	Trojan.Bulz.D4698A
ZoneAlarm	Trojan-Spy.Win32.SpyEyes.blcw
GData	Gen:Variant.Bulz.289162
BitDefenderTheta	Gen:NN.ZexaF.34700.zmKfaCApaHlG
ALYac	Gen:Variant.Bulz.289162
Malwarebytes	Trojan.MalPack.GS
APEX	Malicious
ESET-NOD32	a variant of Win32/Kryptik.HIMI
Rising	Trojan.Kryptik!1.CFEE (CLASSIC)
Ikarus	Trojan.Win32.Crypt
eGambit	Unsafe.AI_Score_94%
Fortinet	W32/Kryptik.HIFA!tr
AVG	Win32:DropperX-gen [Drp]
Panda	Trj/GdSda.A
CrowdStrike	win/malicious_confidence_100% (D)
Qihoo-360	Generic/HEUR/QVM11.1.4A68.Malware.Gen

How to remove Bulz.289162?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Bulz.289162 malicious file