About “Bulz.788441” infection

The Bulz.788441 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Bulz.788441 virus can do?

Presents an Authenticode digital signature
Authenticode signature is invalid
The executable used a known stolen/malicious Authenticode signature
Anomalous binary characteristics

How to determine Bulz.788441?


File Info:
name: CF748707541EAB82CFBF.mlw
path: /opt/CAPEv2/storage/binaries/6cce77ae9e1bb6fc5ec295df19e1da343025a83b7a080a664b823f1c0fd8a34c
crc32: CC4B2756
md5: cf748707541eab82cfbf0b437155ec8d
sha1: 57ad77a364c79a166b51ebd4dfef40b794d6c696
sha256: 6cce77ae9e1bb6fc5ec295df19e1da343025a83b7a080a664b823f1c0fd8a34c
sha512: 335dc407d1a3b8e63409e5af1a9d3aab10752bddd412480e79ee035d973fe0adeb5697e6b4684dd71efae94704d4b6f3f5709f612a73dd6639410a43c91b07f1
ssdeep: 6144:LoISwMd7wvcrqSC6oISwwSc6oISwMd7wvcoaQgKTBKkM:LVSwM+EE6VSww6VSwM+jaQgKTm
type: PE32+ executable (GUI) x86-64, for MS Windows
tlsh: T14D948C02F6ADBCDDD419C031097599E25E36FC312690A21EA7F37F062E31253FD1A66A
sha3_384: 1a062f8f673584182082dbf94dc8412fd0b89a2d2fef7a40dba384f0e51182493b5e7ae5f3b196c8f3e0f56f0ef8a69a
ep_bytes: 4883ec28e8670800004883c428e9f6fd
timestamp: 2021-02-19 13:48:51

Version Info:
CompanyName: Python Software Foundation
FileDescription: Python
FileVersion: 3.9.2
InternalName: Python Application
LegalCopyright: Copyright © 2001-2021 Python Software Foundation. Copyright © 2000 BeOpen.com. Copyright © 1995-2001 CNRI. Copyright © 1991-1995 SMC.
OriginalFilename: pythonw.exe
ProductName: Python
ProductVersion: 3.9.2
Translation: 0x0000 0x04b0

Bulz.788441 also known as:

Lionic	Trojan.Win32.Bulz.4!c
DrWeb	Win32.HLLP.Shohdi.61457
MicroWorld-eScan	Gen:Variant.Bulz.788441
FireEye	Gen:Variant.Bulz.788441
McAfee	RDN/Generic.dx
Cylance	Unsafe
Alibaba	Virus:Win32/Shodi.03c67860
Cybereason	malicious.7541ea
Cyren	W64/Agent.DLO.gen!Eldorado
Symantec	Trojan.Gen.2
TrendMicro-HouseCall	TROJ_GEN.R002C0PLA21
Paloalto	generic.ml
ClamAV	Win.Trojan.FuBu-1
BitDefender	Gen:Variant.Bulz.788441
Avast	Win32:Shodi
Ad-Aware	Gen:Variant.Bulz.788441
Sophos	Generic ML PUA (PUA)
TrendMicro	TROJ_GEN.R002C0PLA21
McAfee-GW-Edition	RDN/Generic.dx
Emsisoft	Gen:Variant.Bulz.788441 (B)
Ikarus	HLLP.Win32.Shodi
GData	Gen:Variant.Bulz.788441
Antiy-AVL	Virus/Win32.Shodi.a
Gridinsoft	Ransom.Win64.Sabsik.sa
Arcabit	Trojan.Bulz.DC07D9
Microsoft	Trojan:Win32/Wacatac.B!ml
Cynet	Malicious (score: 100)
AhnLab-V3	Win32/HLLP.Shodi.X1346
VBA32	Virus.Win32.HLLP.Shodi.a
MAX	malware (ai score=83)
Fortinet	W64/Agent.906B!tr
AVG	Win32:Shodi
CrowdStrike	win/malicious_confidence_80% (W)

How to remove Bulz.788441?

Bulz.788441 removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X