Categories: Malware

Bulz.538137 removal guide

The Bulz.538137 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Bulz.538137 virus can do?

SetUnhandledExceptionFilter detected (possible anti-debug)
Yara rule detections observed from a process memory dump/dropped files/CAPE
Dynamic (imported) function loading detected
Enumerates running processes
Unconventionial binary language: Chinese (Simplified)
Unconventionial language used in binary resources: Chinese (Simplified)
Authenticode signature is invalid
Creates or sets a registry key to a long series of bytes, possibly to store a binary or malware config

How to determine Bulz.538137?


File Info:
name: C5D48C7118BAA18A50EE.mlwpath: /opt/CAPEv2/storage/binaries/cc116f8900fa4384a89014a653eae39794fa9cea72f199889ad324ff5abac8d6crc32: B57A5FE8md5: c5d48c7118baa18a50ee86bd94fdacfdsha1: 24a2d632dfe8d793b099c6f833f1a7d6798e3018sha256: cc116f8900fa4384a89014a653eae39794fa9cea72f199889ad324ff5abac8d6sha512: 5074edfb70e6a73db81747f0f9a51be06e15538a4e041114b903b9ba6cc52ae8759d4a111e71556886ca350542e5ceb4dd37336742515cd2058fb6bc110242dcssdeep: 98304:GPnkErLomZBXq7ThxOfsx0O0RUDR//t//j//Yi//N//l/L:wLnB6iONR//t//j//Yi//N//l/Ltype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1C9E5AD13B043C1F3C519167059EEA7357A3966530B2E8ECBA7C8DE7C2D311A2A77712Asha3_384: bb3bb64ecac4e4b4e8a533ca1b22a01019b340cd17b49a05554687176bd3b1d9cb97d72923c1f529ab081349d5e3fd42ep_bytes: 558bec6aff6878f06e0068d85e4b0064timestamp: 2021-07-04 22:37:17
Version Info:
FileVersion: 1.0.0.0FileDescription: 易语言程序ProductName: 易语言程序ProductVersion: 1.0.0.0LegalCopyright: 作者版权所有 请尊重并使用正版Comments: 本程序使用易语言编写(http://www.eyuyan.com)Translation: 0x0804 0x04b0

Bulz.538137 also known as:

Bkav	W32.AIDetect.malware1
Lionic	Trojan.Win32.Generic.lwoF
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Bulz.538137
FireEye	Generic.mg.c5d48c7118baa18a
ALYac	Gen:Variant.Bulz.538137
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
Sangfor	Trojan.Win32.Convagent.gen
K7AntiVirus	Trojan ( 005246d51 )
Alibaba	RiskWare:Win32/FlyStudio.be24e1be
K7GW	Trojan ( 005246d51 )
Cybereason	malicious.2dfe8d
BitDefenderTheta	Gen:NN.ZexaF.34232.gt0@aGRAGCkj
Cyren	W32/Agent.EW.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Packed.FlyStudio.AA potentially unwanted
TrendMicro-HouseCall	TROJ_GEN.R002C0WBH22
Paloalto	generic.ml
Kaspersky	VHO:Trojan-Dropper.Win32.Convagent.gen
BitDefender	Gen:Variant.Bulz.538137
APEX	Malicious
Ad-Aware	Gen:Variant.Bulz.538137
Sophos	Mal/Generic-S
Comodo	TrojWare.Win32.Agent.OSCF@5rs7jr
DrWeb	Trojan.Spambot.15834
Zillya	Dropper.Convagent.Win32.323
TrendMicro	TROJ_GEN.R002C0WBH22
McAfee-GW-Edition	BehavesLike.Win32.Autorun.wh
Emsisoft	Gen:Variant.Bulz.538137 (B)
Ikarus	Trojan.Win32.MBRlock
GData	Win32.Trojan.PSE.5LSHNI
Jiangmin	RiskTool.FlyStudio.fwf
eGambit	Generic.Malware
MAX	malware (ai score=100)
Antiy-AVL	Trojan/Generic.ASCommon.FA
Kingsoft	Win32.Troj.Undef.(kcloud)
Microsoft	Trojan:Win32/Emotet!ml
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win.Generic.C4538391
Acronis	suspicious
McAfee	GenericRXAA-AA!C5D48C7118BA
TACHYON	Trojan-Dropper/W32.Convagent.3248128
VBA32	BScope.Trojan.Tonmye
Malwarebytes	PUP.Optional.ChinAd
Avast	Win32:TrojanX-gen [Trj]
Rising	HackTool.GameHack!1.B2A6 (CLOUD)
SentinelOne	Static AI – Malicious PE
MaxSecure	Dropper.Dinwod.frindll
Fortinet	W32/CoinMiner.65CA!tr
AVG	Win32:TrojanX-gen [Trj]
Panda	Trj/GdSda.A