Bulz.347901 (file analysis)

The Bulz.347901 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Bulz.347901 virus can do?

Dynamic (imported) function loading detected
Authenticode signature is invalid
CAPE detected the caliber malware family
Binary compilation timestomping detected

How to determine Bulz.347901?


File Info:
name: 530D79B30B23D2109836.mlw
path: /opt/CAPEv2/storage/binaries/f8cf442b6164bab3b2b0da9849c71faf990c0640dabeb3363509d709a1c4f299
crc32: F84CA2A1
md5: 530d79b30b23d210983645a487ccf0a4
sha1: 29c0f46a657d00fdd542efa7bc1d0fb5b8fa1367
sha256: f8cf442b6164bab3b2b0da9849c71faf990c0640dabeb3363509d709a1c4f299
sha512: 1a773f7de632226eae19352b6efcb2bb522a410df57dc426f218b7b041fb2f199344c6782fcefbe6739faa619bcf1e58abcc26697fad6b10e61fc7ce90eb8293
ssdeep: 3072:Q97+c0UgRr+xXyFpsXMJoNB0J3lysRIQzmbxtyjMuDEHOsc2dC13hI/KQ73Wmec8:M+cIRN9+NB0ryqIQq3oMuDEusHA
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T10B14184017EA07AAF2FF57B9D0F521A9C371B4536A3EDB8E5C4150EA6813780D980FA7
sha3_384: a0c0d21f2655998192f16270a272e8e32490a9d0bbb41e87281d59d84625b88227dc078c98932366eb05e455d42e04f5
ep_bytes: ff250020400000000000000000000000
timestamp: 2104-01-01 18:38:18

Version Info:
Translation: 0x0000 0x04b0
Comments: 44 CALIBER
CompanyName: 44 CALIBER
FileDescription: 44 CALIBER
FileVersion: 1.6.2.0
InternalName: Insidious.exe
LegalCopyright: FuckTheSystem Copyright ©  2021
LegalTrademarks: 
OriginalFilename: Insidious.exe
ProductName: 44 CALIBER
ProductVersion: 1.6.2.0
Assembly Version: 1.6.2.0

Bulz.347901 also known as:

Elastic	malicious (high confidence)
ClamAV	Win.Ransomware.Stupid-9871677-0
ALYac	Gen:Variant.Bulz.347901
Malwarebytes	Spyware.PasswordStealer.44
K7AntiVirus	Password-Stealer ( 0057016e1 )
K7GW	Password-Stealer ( 0057016e1 )
Cybereason	malicious.30b23d
Cyren	W32/MSIL_Agent.BWD.gen!Eldorado
ESET-NOD32	a variant of MSIL/PSW.Agent.SPJ
Cynet	Malicious (score: 100)
BitDefender	Gen:Variant.Bulz.347901
MicroWorld-eScan	Gen:Variant.Bulz.347901
Emsisoft	Gen:Variant.Bulz.347901 (B)
McAfee-GW-Edition	GenericRXPV-SG!530D79B30B23
SentinelOne	Static AI – Suspicious PE
FireEye	Gen:Variant.Bulz.347901
Sophos	ML/PE-A
APEX	Malicious
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
GData	Gen:Variant.Bulz.347901
AhnLab-V3	Malware/Win.DataStealer.C4596611
McAfee	GenericRXPV-SG!530D79B30B23
MAX	malware (ai score=83)
Ikarus	Trojan.MSIL.Spy
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	MSIL/Agent.RML!tr.pws

How to remove Bulz.347901?

Bulz.347901 removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X