Should I remove “Bulz.429424”?

The Bulz.429424 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Bulz.429424 virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Guard pages use detected – possible anti-debugging.
• Dynamic (imported) function loading detected
• At least one IP Address, Domain, or File Name was found in a crypto call
• CAPE extracted potentially suspicious content
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Anomalous .NET characteristics
• Behavioural detection: Injection (Process Hollowing)
• Executed a process and injected code into it, probably while unpacking
• Attempts to remove evidence of file being downloaded from the Internet
• Code injection with CreateRemoteThread in a remote process
• Sniffs keystrokes
• Behavioural detection: Injection (inter-process)
• Behavioural detection: Injection with CreateRemoteThread in a remote process
• Created a process from a suspicious location
• Collects and encrypts information about the computer likely to send to C2 server
• Installs itself for autorun at Windows startup
• Creates a copy of itself
• Anomalous binary characteristics

How to determine Bulz.429424?

File Info:
name: C09E8E8EC4715BC4BB86.mlw
path: /opt/CAPEv2/storage/binaries/251e1424b3ffc82c7807ccde40f5c871578ef424a86961af61cda1a9140da156
crc32: 03E7CCBB
md5: c09e8e8ec4715bc4bb860305244301a7
sha1: 59d3ac4d06619211049e840780947366ce3c0943
sha256: 251e1424b3ffc82c7807ccde40f5c871578ef424a86961af61cda1a9140da156
sha512: 610d2d2a2978791df2b95f880c7017564be4c860ef391bc1c058ffef0cc8e86126db2e6c381db80c49b243264c983213e1627bbe7814be6482fbe72b836b2060
ssdeep: 12288:LW0dKOsuP/t3ey1R2tz+jnvbRNQIZZKZI4ZrGt9lZGneKxN5kMK4941c:LW0dKOsuPVZ1R2IjnD8IZWFK9vGneKxA
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T103E412432E104CA2E5BD63F16D22DBB163398883EB63DD13D33077CE48576F45A1A6A6
sha3_384: 85493fe11ea7808d3728154bc52e5dd83cc229946e0e3406a09d44a3728db27b21627e268762c00ea423662cee5b988a
ep_bytes: ff25f4404000cccccccc033002001d00
timestamp: 2016-12-03 01:39:24

Version Info:
0: [No Data]

Bulz.429424 also known as:

How to remove Bulz.429424?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.