Bulz.6656 information

The Bulz.6656 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Bulz.6656 virus can do?

Executable code extraction
Injection (inter-process)
Injection (Process Hollowing)
Attempts to connect to a dead IP:Port (1 unique times)
Creates RWX memory
Repeatedly searches for a not-found process, may want to run with startbrowser=1 option
The binary likely contains encrypted or compressed data.
Uses Windows utilities for basic functionality
Executed a process and injected code into it, probably while unpacking
Attempts to remove evidence of file being downloaded from the Internet
Installs itself for autorun at Windows startup
Spoofs its process name and/or associated pathname to appear as a legitimate process
Creates a hidden or system file
Collects information to fingerprint the system
Attempts to modify Explorer settings to prevent hidden files from being displayed
Uses suspicious command line tools or Windows utilities

Related domains:

ns.dotbit.me

ns1.any.dns.d0wn.biz

ns1.random.dns.d0wn.biz

servicepro.bit

ns2.random.dns.d0wn.biz

ns2.fr.dns.d0wn.biz

ns1.sg.dns.d0wn.biz

ns1.nl.dns.d0wn.biz

How to determine Bulz.6656?


File Info:
crc32: D8787756
md5: 8f8aa1fa370bb48822d59d77cb71421b
name: 8F8AA1FA370BB48822D59D77CB71421B.mlw
sha1: b97c9b91dc202cf19cc21384273b074c60554c00
sha256: f01c9a4f0c0d05f2db515113104af1e1306c4c18c42efda7f594963d8285ff21
sha512: 59163378e857faff05989ce43124b257df8b292bfa48685504221234fcc8a2d792cacdf3a01b886cfa3c7732524d9d279c3374672e520361f9940387b5089002
ssdeep: 6144:6tERxjKUtfLCfT0WLCpt8bjyQbndhJJ19QrDV/wPVtFb3+j:rRxWMTCwV9QbjJJbQrZ4PHFD+
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
0: [No Data]

Bulz.6656 also known as:

Bkav	W32.AIDetect.malware1
K7AntiVirus	Riskware ( 0040eff71 )
Lionic	Trojan.Win32.Blocker.j!c
Elastic	malicious (high confidence)
DrWeb	Trojan.Kasidet.1
Cynet	Malicious (score: 100)
ALYac	Gen:Variant.Bulz.6656
Cylance	Unsafe
Zillya	Trojan.Blocker.Win32.35359
CrowdStrike	win/malicious_confidence_70% (D)
Alibaba	Ransom:Win32/Blocker.94b68248
K7GW	Riskware ( 0040eff71 )
Cybereason	malicious.a370bb
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Kryptik.FQZN
APEX	Malicious
Avast	Win32:Malware-gen
Kaspersky	Trojan-Ransom.Win32.Blocker.jmfn
BitDefender	Gen:Variant.Bulz.6656
NANO-Antivirus	Trojan.Win32.Blocker.falctu
MicroWorld-eScan	Gen:Variant.Bulz.6656
Tencent	Win32.Trojan.Blocker.Eehu
Ad-Aware	Gen:Variant.Bulz.6656
Sophos	Mal/Generic-S
BitDefenderTheta	Gen:NN.ZexaF.34170.qyW@aSQ531ei
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	Mal_Cerber-3
McAfee-GW-Edition	BehavesLike.Win32.Generic.dc
FireEye	Generic.mg.8f8aa1fa370bb488
Emsisoft	Gen:Variant.Bulz.6656 (B)
SentinelOne	Static AI – Malicious PE
Jiangmin	Trojan.Blocker.ezd
Avira	HEUR/AGEN.1127212
eGambit	Unsafe.AI_Score_99%
Kingsoft	Win32.Troj.Undef.(kcloud)
Microsoft	VirTool:Win32/Injector.GE
Arcabit	Trojan.Bulz.D1A00
GData	Gen:Variant.Bulz.6656
Acronis	suspicious
McAfee	Artemis!8F8AA1FA370B
MAX	malware (ai score=85)
VBA32	BScope.Trojan.Yakes
Panda	Trj/GdSda.A
TrendMicro-HouseCall	Mal_Cerber-3
Rising	Trojan.Generic@ML.100 (RDML:iWWeyUPOSonEA56QUXHajQ)
Ikarus	Virus.Win32.Injector
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/Blocker.JMFN!tr
AVG	Win32:Malware-gen
Paloalto	generic.ml

How to remove Bulz.6656?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.