Categories: Malware

About “Bulz.43669” infection

The Bulz.43669 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Bulz.43669 virus can do?

SetUnhandledExceptionFilter detected (possible anti-debug)
Behavioural detection: Executable code extraction – unpacking
Yara rule detections observed from a process memory dump/dropped files/CAPE
Creates RWX memory
NtSetInformationThread: attempt to hide thread from debugger
Dynamic (imported) function loading detected
CAPE extracted potentially suspicious content
Unconventionial binary language: Polish
Unconventionial language used in binary resources: Polish
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid

How to determine Bulz.43669?


File Info:
name: F3A7010F300BA8426C75.mlwpath: /opt/CAPEv2/storage/binaries/30865d15d97565f46bd25e23e47c752f625906867122b632e5bbfd750bad6980crc32: 87564685md5: f3a7010f300ba8426c75068910afab80sha1: d5b5b892c561f8b884df6965193327bfbfad0243sha256: 30865d15d97565f46bd25e23e47c752f625906867122b632e5bbfd750bad6980sha512: e3250b149a5c60b30a37a70292dad380370e72e463c733311dae750737c29a04811eb63dd47d471036ed9e048fb0f89a65fbc0d13cff57854d42c50a32f09773ssdeep: 3072:lvDf3TQcHU7a0OAes+4+uoNd8AAoHLJW/07L3/Pq5ECeOFp5:VfjQEIZOr4+uoNW7HI4heOtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1E4F3AE1037E0E0B2D0A219346AF1E6B10E7EBD710679914B63E85B796F70ADC9F3531Asha3_384: 4585a5f99bbf1b36f4139777d30dc861fa2d6232617fbcc29a2300fb58b56af68e59187d061f021920b9b9741468f392ep_bytes: e8a6560000e989feffff8bff558bec83timestamp: 2013-05-24 22:39:43
Version Info:
CompanyName: PixelByte Software LTDFileDescription: Demand UI Manager Control ProgramFileVersion: 5.4.2.2InternalName: demuimgrLegalCopyright: Copyright (C) 2008-2013 - PixelByte Software LTDOriginalFilename: demuimgrProductName: Demand UI Manager Control ProgramProductVersion: 5.4.2.2Translation: 0x0415 0x04b0

Bulz.43669 also known as:

Bkav	W32.AIDetect.malware2
Lionic	Trojan.Win32.Zbot.4!c
Cynet	Malicious (score: 100)
FireEye	Generic.mg.f3a7010f300ba842
ALYac	Gen:Variant.Bulz.43669
Cylance	Unsafe
VIPRE	Trojan.Win32.Reveton.a (v)
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Riskware ( 0040eff71 )
Alibaba	TrojanSpy:Win32/Urausy.a5b3a12a
K7GW	Riskware ( 0040eff71 )
CrowdStrike	win/malicious_confidence_100% (W)
VirIT	Trojan.Win32.Generic.ACSW
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Kryptik.BBYB
APEX	Malicious
Paloalto	generic.ml
Kaspersky	Trojan-Spy.Win32.Zbot.wwvs
BitDefender	Gen:Variant.Bulz.43669
NANO-Antivirus	Trojan.Win32.RiskGen.bsbaym
MicroWorld-eScan	Gen:Variant.Bulz.43669
Avast	Win32:Urausy-AE [Trj]
Tencent	Win32.Trojan-spy.Zbot.Eddn
Ad-Aware	Gen:Variant.Bulz.43669
Emsisoft	Gen:Variant.Bulz.43669 (B)
Comodo	Malware@#lpbliqc5qsv0
DrWeb	Trojan.PWS.Panda.4389
Zillya	Trojan.Kryptik.Win32.917627
TrendMicro	TROJ_SPNR.14FD13
McAfee-GW-Edition	Ransom-FCDW!F3A7010F300B
Sophos	Mal/Generic-R + Mal/EncPk-AKK
SentinelOne	Static AI – Suspicious PE
GData	Gen:Variant.Bulz.43669
Jiangmin	Trojan/Foreign.ghf
Webroot	Trojan.Dropper.Gen
Avira	HEUR/AGEN.1224299
MAX	malware (ai score=100)
Antiy-AVL	Trojan[Ransom]/Win32.Foreign
Kingsoft	Win32.Troj.Undef.(kcloud)
Arcabit	Trojan.Bulz.DAA95
SUPERAntiSpyware	Trojan.Agent/Gen-Graftor
ZoneAlarm	Trojan-Spy.Win32.Zbot.wwvs
Microsoft	Ransom:Win32/Urausy.C
Acronis	suspicious
McAfee	Ransom-FCDW!F3A7010F300B
VBA32	Hoax.Foreign
Malwarebytes	Generic.Malware/Suspicious
TrendMicro-HouseCall	TROJ_SPNR.14FD13
Rising	Spyware.Zbot!8.16B (CLOUD)
Yandex	Trojan.Foreign!DNdlym87h7I
Ikarus	Trojan-Ransom.Foreign
eGambit	Generic.Malware
Fortinet	W32/Foreign.CTBV!tr
BitDefenderTheta	Gen:NN.ZexaF.34212.ku0@aaY6LqnO
AVG	Win32:Urausy-AE [Trj]
Cybereason	malicious.f300ba
Panda	Trj/Dtcontx.E