What is “Trojan.Proxy.Bunitu.BB”?

The Trojan.Proxy.Bunitu.BB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.Proxy.Bunitu.BB virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Behavioural detection: Executable code extraction – unpacking
• Creates RWX memory
• Guard pages use detected – possible anti-debugging.
• Dynamic (imported) function loading detected
• A process created a hidden window
• CAPE extracted potentially suspicious content
• Authenticode signature is invalid
• A scripting utility was executed
• Uses Windows utilities for basic functionality
• Attempts to identify installed AV products by registry key
• Attempts to disable Windows Defender
• Attempts to modify Windows Defender using PowerShell

How to determine Trojan.Proxy.Bunitu.BB?

File Info:
name: 9040DC30AFDF8513E0F1.mlw
path: /opt/CAPEv2/storage/binaries/db01b893859df948e39a39ee51eb95096026bcd730079add3598eaab63e6677e
crc32: A7D0AB76
md5: 9040dc30afdf8513e0f133807380fad5
sha1: 3d09efb5adb384346c5681112b72c62dc6fde394
sha256: db01b893859df948e39a39ee51eb95096026bcd730079add3598eaab63e6677e
sha512: 50c7b2cf1ee7a7cce9ad2babe80ee81f1909892e4186d98bc5c4e291f72ec8ca9030fe52f2ba21cd2c7ec9178e9156bc1d565b506c722e8f02c1682cb3a0cbf8
ssdeep: 768:aRmJNxBJo/Kw5dyVgIZs+Ph5pWJR2FMFVKaYru9kwwfFg4bL+:CmJZ8f5dySI5+YFMFTYeQFDbL+
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1B4546C4A976497FBFE2C02721F36314ED6337735876C17C711211935EEA22FA2C9922A
sha3_384: 5d5830cfaf6052950cb9d300291e1fe287b1dffbe67eb73868b4c50e92ec4615f0300b13bacb23705b275b23147cc7c9
ep_bytes: e87fbc0300a326884400e869bc0300a3
timestamp: 2019-09-04 08:07:12

Version Info:
0: [No Data]

Trojan.Proxy.Bunitu.BB also known as:

How to remove Trojan.Proxy.Bunitu.BB?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.