Categories: Malware

Bulz.416501 removal tips

The Bulz.416501 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Bulz.416501 virus can do?

Behavioural detection: Executable code extraction – unpacking
Yara rule detections observed from a process memory dump/dropped files/CAPE
Creates RWX memory
Dynamic (imported) function loading detected
The binary contains an unknown PE section name indicative of packing
The binary likely contains encrypted or compressed data.
The executable is likely packed with VMProtect
Authenticode signature is invalid
Tries to suspend Cuckoo threads to prevent logging of malicious activity
Tries to unhook or modify Windows functions monitored by Cuckoo

How to determine Bulz.416501?


File Info:
name: 906A30920714850DD358.mlwpath: /opt/CAPEv2/storage/binaries/1836d30c8e3259faa1bb21abb9dc8a0c2bc7e4b927596343ec7e1fe133fa1b23crc32: 85350D39md5: 906a30920714850dd35837e5b4d9a5c6sha1: 0603092d879ccd528fcea41c5aff017cac449ab7sha256: 1836d30c8e3259faa1bb21abb9dc8a0c2bc7e4b927596343ec7e1fe133fa1b23sha512: 754ac86fef3e5713dbb362bf3d7ef58b8331002099d550c3508619830f241b4218d3cb420b100b7ff35430e715ad42849871ceaba7c21906c1924874a7014bc2ssdeep: 98304:N+6oXU/1cDgCoZnr10ifGtGVEXfg2XsbXaiQ0Bg64Y8:I6oKFhfGTXopXk0Bg48type: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1FB1633867AC71158D0F0A73044CE7E658B6BB3679105A126A0A86CC7BFFF33F1E95681sha3_384: 35dab9e9095fdbc28c1d366eccc06aa34bd224eae802c71051947acdd7014adb6ed6dba87a14a4281f96dfb957bb3a0cep_bytes: eb085d21220000000000e9d8adfeff00timestamp: 2011-03-28 05:42:56
Version Info:
FileDescription: Windows 激活工具FileVersion: 1.8.0.0ProductName: Windows 激活工具ProductVersion: 1.8.0.0Translation: 0x0409 0x04e4

Bulz.416501 also known as:

Bkav	W32.AIDetect.malware2
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Bulz.416501
FireEye	Generic.mg.906a30920714850d
ALYac	Gen:Variant.Bulz.416501
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
Alibaba	Ransom:Win32/PornoAsset.1c42cbe5
CrowdStrike	win/malicious_confidence_60% (W)
BitDefenderTheta	Gen:NN.ZexaF.34742.@Z0@aG9umwci
tehtris	Generic.Malware
ESET-NOD32	a variant of Win32/Packed.VMProtect.E
Kaspersky	Trojan-Ransom.Win32.PornoAsset.dbrt
BitDefender	Gen:Variant.Bulz.416501
Avast	Win32:Dropper-gen [Drp]
Tencent	Win32.Trojan.Pornoasset.Hqva
Ad-Aware	Gen:Variant.Bulz.416501
Sophos	Generic ML PUA (PUA)
McAfee-GW-Edition	BehavesLike.Win32.Generic.rc
Trapmine	malicious.moderate.ml.score
Emsisoft	Gen:Variant.Bulz.416501 (B)
SentinelOne	Static AI – Malicious PE
GData	Gen:Variant.Bulz.416501
Avira	HEUR/AGEN.1203975
MAX	malware (ai score=87)
Kingsoft	Win32.Troj.Undef.(kcloud)
Microsoft	Trojan:Win32/Trickbot!ml
Cynet	Malicious (score: 100)
McAfee	Packed-GV!906A30920714
Malwarebytes	Malware.Heuristic.1003
APEX	Malicious
Rising	Trojan.Generic@AI.100 (RDML:g+Cz8NosxHgjZzayYMSLPg)
Ikarus	Trojan.Win32.VMProtect
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/PossibleThreat
AVG	Win32:Dropper-gen [Drp]
Cybereason	malicious.d879cc