How to remove “Bulz.311626”?

The Bulz.311626 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Bulz.311626 virus can do?

Dynamic (imported) function loading detected
CAPE extracted potentially suspicious content
Authenticode signature is invalid
Binary compilation timestomping detected

How to determine Bulz.311626?


File Info:
name: 4F6E4DFE69B85F1B1D4F.mlw
path: /opt/CAPEv2/storage/binaries/cc82e31ec3a1c2fcbd4f0c71d034430cb85373128ef2b1cf96b530229b7a0fb3
crc32: 8E1DE994
md5: 4f6e4dfe69b85f1b1d4f16847fd576df
sha1: abafe97be92facd1c5f1cee3c7d9ae692016a6de
sha256: cc82e31ec3a1c2fcbd4f0c71d034430cb85373128ef2b1cf96b530229b7a0fb3
sha512: 8bdd87889d725d1c12ba3e615b06366d26b0f3a8c9d3e1e90af5f733ae9ebbe06803711ce5b875e71e8cd47f2b413e652d132060160b22f422bb970604b38be8
ssdeep: 96:4AkAv6aM7OwYd3aky6IwV5pZTDms0di/PRfzNt:4AkAv6aM7OwYd3azwV5L2di/5J
type: PE32 executable (console) Intel 80386, for MS Windows
tlsh: T1F2F1960163E94E32ECBF9BB048A343401B35FA47CD76DB5E15CE722E1E66A544512F27
sha3_384: d18eba0c781543892a1e7a5d701a2f61211cf1899634bb7d9c5dfa69ffd70a42254383ae5aac6a7d192c5d240dab3e25
ep_bytes: ff250020400000000000000000000000
timestamp: 2069-04-13 00:18:11

Version Info:
Translation: 0x0000 0x04b0
Comments: 
CompanyName: 
FileDescription: Discord Webhook Spammer
FileVersion: 1.0.0.0
InternalName: Discord Webhook Spammer.exe
LegalCopyright: Copyright ©  2020
LegalTrademarks: 
OriginalFilename: Discord Webhook Spammer.exe
ProductName: Discord Webhook Spammer
ProductVersion: 1.0.0.0
Assembly Version: 1.0.0.0

Bulz.311626 also known as:

Lionic	Trojan.Win32.Generic.4!c
MicroWorld-eScan	Gen:Variant.Bulz.311626
FireEye	Gen:Variant.Bulz.311626
ALYac	Gen:Variant.Bulz.311626
Cylance	Unsafe
K7AntiVirus	Hacktool ( 00576d591 )
Alibaba	HackTool:MSIL/Agentb.1efa27e9
K7GW	Hacktool ( 00576d591 )
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/HackTool.Spammer.DM
TrendMicro-HouseCall	TROJ_GEN.R002H09LB21
Kaspersky	HEUR:HackTool.MSIL.Agentb.gen
BitDefender	Gen:Variant.Bulz.311626
Avast	Win32:MalwareX-gen [Trj]
Tencent	Win32.Trojan.Bulz.Pftu
Ad-Aware	Gen:Variant.Bulz.311626
Emsisoft	Gen:Variant.Bulz.311626 (B)
F-Secure	Heuristic.HEUR/AGEN.1206896
McAfee-GW-Edition	Artemis!Trojan
GData	Gen:Variant.Bulz.311626
Avira	HEUR/AGEN.1206896
Antiy-AVL	HackTool/MSIL.Spammer
Gridinsoft	Ransom.Win32.Sabsik.sa
Arcabit	Trojan.Bulz.D4C14A
Microsoft	Trojan:Win32/Wacatac.B!ml
Cynet	Malicious (score: 99)
McAfee	Artemis!4F6E4DFE69B8
MAX	malware (ai score=89)
APEX	Malicious
SentinelOne	Static AI – Suspicious PE
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	MSIL/Spammer.DM!tr
AVG	Win32:MalwareX-gen [Trj]
Cybereason	malicious.e69b85
Panda	Trj/GdSda.A

How to remove Bulz.311626?

Bulz.311626 removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X