About “Trojan.Casur” infection

The Trojan.Casur is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

What Trojan.Casur virus can do?

• Executable code extraction
• Creates RWX memory
• Possible date expiration check, exits too soon after checking local time
• Mimics the system’s user agent string for its own requests
• A process attempted to delay the analysis task.
• Expresses interest in specific running processes
• Drops a binary and executes it
• The binary likely contains encrypted or compressed data.
• Uses Windows utilities for basic functionality
• Attempts to repeatedly call a single API many times in order to delay analysis time
• Creates a copy of itself
• Anomalous binary characteristics

How to determine Trojan.Casur?

File Info:
crc32: 09BF3E6Amd5: b50be0db6ed78d6b0f7ff6aef510f3a9name: 068qc3tja.exesha1: 3e4fe28ffbae748a5d92a639c68f5145309d07e5sha256: 063f436837f673c3e9655628cf63ad0aa6b1078335f219f5d168a3591223810asha512: af8c9f01b298712797f4497aef99145c618d129fb6beb92523c8e1bb2c9cab751cdee0ec51f27d5ae9f2ba53e2e59a7e9a47334911c86f515a9cf7f9f79ba4dassdeep: 3072:lOz1rBhkQYQe++Ti7BYkTQTR/Kw1D15It5kE6uKr30qwwvCFUla2+UsSYQ:qrBhkQYX6ETpf/I71A3zwwcUla2+UDtype: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Version Info:
0: [No Data]

Trojan.Casur also known as:

MicroWorld-eScan	Trojan.Autoruns.GenericKDS.42001713
FireEye	Generic.mg.b50be0db6ed78d6b
CAT-QuickHeal	Trojan.Casur
McAfee	Emotet-FOL!B50BE0DB6ED7
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
K7AntiVirus	Trojan ( 0055b2751 )
BitDefender	Trojan.Autoruns.GenericKDS.42001713
K7GW	Trojan ( 0055b2751 )
Cybereason	malicious.ffbae7
TrendMicro	TROJ_GEN.R057C0DKA19
F-Prot	W32/Emotet.AAU.gen!Eldorado
Symantec	Trojan Horse
APEX	Malicious
Avast	Win32:Malware-gen
GData	Trojan.Autoruns.GenericKDS.42001713
Kaspersky	Trojan-Banker.Win32.Emotet.eagj
Alibaba	Trojan:Win32/Skeeyah.1a4ae2b4
NANO-Antivirus	Trojan.Win32.Emotet.ggndhl
ViRobot	Trojan.Win32.Emotet.211912
AegisLab	Trojan.Win32.Generic.4!c
Rising	Trojan.Emotet!1.BF04 (CLASSIC)
Endgame	malicious (high confidence)
DrWeb	Trojan.Emotet.762
Zillya	Trojan.Emotet.Win32.18678
Invincea	heuristic
McAfee-GW-Edition	BehavesLike.Win32.Pykse.dc
Sophos	Troj/Emotet-BUK
Ikarus	Trojan-Banker.Emotet
Cyren	W32/Trojan.PACX-8198
Jiangmin	Trojan.Banker.Emotet.men
Webroot	W32.Trojan.Gen
Avira	TR/AD.Emotet.lhunn
MAX	malware (ai score=84)
Antiy-AVL	Trojan[Banker]/Win32.Emotet
Arcabit	Trojan.Autoruns.GenericS.D280E531
ZoneAlarm	Trojan-Banker.Win32.Emotet.eagj
Microsoft	Trojan:Win32/Skeeyah.A!MTB
AhnLab-V3	Trojan/Win32.Emotet.R298664
VBA32	Trojan.Emotet
ALYac	Trojan.Agent.Emotet
Ad-Aware	Trojan.Autoruns.GenericKDS.42001713
Panda	Trj/GdSda.A
ESET-NOD32	a variant of Win32/Kryptik.GYEQ
TrendMicro-HouseCall	TROJ_GEN.R057C0DKA19
Yandex	Trojan.GenKryptik!
SentinelOne	DFI – Suspicious PE
MaxSecure	Trojan.Malware.74686149.susgen
Fortinet	W32/TrickBot.CC!tr
BitDefenderTheta	Gen:NN.ZexaF.32250.mOX@amtf2ff
AVG	Win32:Malware-gen
Paloalto	generic.ml
CrowdStrike	win/malicious_confidence_90% (W)
Qihoo-360	HEUR/QVM20.1.265D.Malware.Gen

How to remove Trojan.Casur?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.