Bulz.366131 information

The Bulz.366131 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Bulz.366131 virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Uses Windows utilities for basic functionality
• Reads data out of its own binary image
• Unconventionial binary language: Chinese (Simplified)
• Unconventionial language used in binary resources: Chinese (Simplified)
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• The executable is likely packed with VMProtect
• Authenticode signature is invalid
• Behavioural detection: Injection (inter-process)
• Attempts to identify installed AV products by registry key
• Binary file triggered YARA rule
• Attempted to write directly to a physical drive
• Attempts to modify proxy settings
• Touches a file containing cookies, possibly for information gathering
• Yara detections observed in process dumps, payloads or dropped files

How to determine Bulz.366131?

File Info:
name: 9E0D56DF45EF3245AE96.mlw
path: /opt/CAPEv2/storage/binaries/fdd57f9743f5a8b3e2f2610ace18ae56f77c382f75f6e2e0a4da3ff391b8c7b3
crc32: 571DC944
md5: 9e0d56df45ef3245ae965734f6905568
sha1: 55875013df3d735bea6d3d26cd3ff4eded28acd7
sha256: fdd57f9743f5a8b3e2f2610ace18ae56f77c382f75f6e2e0a4da3ff391b8c7b3
sha512: 7a104ee959e2141d718487ce907bb342ac3f6e35442b8d2d5fe6a0d1be9be999f74b5d9339d3ceabcb7ed07c28a4e9db6c61c74be8030e935c560a5fcb7fb90e
ssdeep: 196608:RIxrYd9cE0i64C/oUHbuESfRxNnRLIx1Sy8hT9Wtn7TmHZqkOb4HgOMaL9batLo:GrecELi3HbRSZ3G8hT9MnmHkk84HgOMM
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1D8C63336122121C7E1E9CC72AA37FEE477F5632E4DC3A8B4A5D66EC120371E4E102697
sha3_384: a3536f645dd4b98da3e278a98588a27205d1de3ed8db817685f363ef83af59310e542e47b6bc055bb6e89aecf6317621
ep_bytes: 68ff43b7bbe89ae659ff55c3c3b3123c
timestamp: 2019-09-27 06:46:21

Version Info:
FileDescription: 360 安全卫士
FileVersion: 12.0.0.2075
InternalName: 360 安全卫士
LegalCopyright: (C)360.cn Inc.All Rights Reserved.
OriginalFilename: Setup.exe
ProductName: 360 安全卫士
ProductVersion: 12.0.0.2075
Translation: 0x0804 0x04b0

Bulz.366131 also known as:

How to remove Bulz.366131?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.