Bulz.331660 removal tips

The Bulz.331660 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Bulz.331660 virus can do?

Dynamic (imported) function loading detected
CAPE extracted potentially suspicious content
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid

How to determine Bulz.331660?


File Info:
name: 8445BA71F676E5365E10.mlw
path: /opt/CAPEv2/storage/binaries/30f196ef79a797dbd19867890765b87e409b06315628445837e7623b15fb2281
crc32: 2E11C2F5
md5: 8445ba71f676e5365e106bc156dafb13
sha1: c4504fe33898c293efbebb26b99a0aacb4bad665
sha256: 30f196ef79a797dbd19867890765b87e409b06315628445837e7623b15fb2281
sha512: b0606a96fdb360754d673cd15a7cff6d72ac224a3d4c37e2a95e8da838ccbb347b5e6727c3d6856ea349cc1cfe641c4ddaccd6021c6a2a988c58a8f2d7cd4cc4
ssdeep: 192:hFAQc0pNgx0g2glarZm4nloYk4vNIDLTHQWBlGl3lr:hF9WWFk41+LTXril
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T16052061A13C68239DF6E4A7318A3A35047F4CE45E562AB3F29A4739B1DB32000B93B75
sha3_384: 51d03e02a6ac131a2d47486a50cab684407b3bb98118a60ab6e4b7a24bd263b8652abe41e9214538d06cc4f6736dbb60
ep_bytes: ff250020400000000000000000000000
timestamp: 2021-01-26 07:50:25

Version Info:
Translation: 0x0000 0x04b0
FileDescription: KKKKKKKK
FileVersion: 1.0.0.0
InternalName: KKKKKKKK.exe
LegalCopyright: Copyright ©  2021
OriginalFilename: KKKKKKKK.exe
ProductName: KKKKKKKK
ProductVersion: 1.0.0.0
Assembly Version: 1.0.0.0

Bulz.331660 also known as:

Lionic	Trojan.MSIL.Bladabindi.m!c
MicroWorld-eScan	Gen:Variant.Bulz.331660
FireEye	Generic.mg.8445ba71f676e536
ALYac	Gen:Variant.Bulz.331660
Cylance	Unsafe
Sangfor	Trojan.MSIL.Agent.GBH
K7AntiVirus	Trojan-Downloader ( 005629211 )
Alibaba	Backdoor:MSIL/Bladabindi.9e4d2000
K7GW	Trojan-Downloader ( 005629211 )
Cybereason	malicious.1f676e
Elastic	malicious (high confidence)
ESET-NOD32	a variant of MSIL/TrojanDownloader.Agent.GBH
APEX	Malicious
Paloalto	generic.ml
Kaspersky	HEUR:Backdoor.MSIL.Bladabindi.gen
BitDefender	Gen:Variant.Bulz.331660
Avast	Win32:RATX-gen [Trj]
Tencent	Msil.Trojan-downloader.Agent.Dypx
Ad-Aware	Gen:Variant.Bulz.331660
Sophos	Mal/Generic-S
Comodo	Malware@#3rz2cwi5rhaam
DrWeb	Trojan.DownloaderNET.71
McAfee-GW-Edition	Artemis!Trojan
Emsisoft	Gen:Variant.Bulz.331660 (B)
SentinelOne	Static AI – Malicious PE
GData	Gen:Variant.Bulz.331660
Jiangmin	Backdoor.MSIL.eeos
Webroot	W32.Malware.Gen
Avira	HEUR/AGEN.1249115
Arcabit	Trojan.Bulz.D50F8C
ZoneAlarm	HEUR:Backdoor.MSIL.Bladabindi.gen
Microsoft	Trojan:Win32/Ymacco.AA30
Cynet	Malicious (score: 99)
AhnLab-V3	Malware/Win32.RL_Generic.C4108332
McAfee	Artemis!8445BA71F676
MAX	malware (ai score=81)
VBA32	Backdoor.MSIL.Bladabindi
Malwarebytes	Backdoor.Bladabindi
Rising	Trojan.Generic/MSIL@AI.100 (RDM.MSIL:fJ7JweZFSR4txJgqO+vJgw)
Yandex	Trojan.DL.Agent!uow7zcaUnOE
Ikarus	Trojan-Downloader.MSIL.Agent
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	MSIL/Agent.GBH!tr.dldr
BitDefenderTheta	Gen:NN.ZemsilF.34742.aq0@aO8bOie
AVG	Win32:RATX-gen [Trj]
Panda	Trj/GdSda.A
CrowdStrike	win/malicious_confidence_100% (W)

How to remove Bulz.331660?

Bulz.331660 removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X