Categories: Malware

Ursu.113725 removal guide

The Ursu.113725 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Ursu.113725 virus can do?

SetUnhandledExceptionFilter detected (possible anti-debug)
Creates RWX memory
Guard pages use detected – possible anti-debugging.
Dynamic (imported) function loading detected
CAPE extracted potentially suspicious content
The binary contains an unknown PE section name indicative of packing
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
Sniffs keystrokes
Creates known Njrat/Bladabindi RAT registry keys
Anomalous binary characteristics

How to determine Ursu.113725?


File Info:
name: 574A3592C32EB216DD58.mlwpath: /opt/CAPEv2/storage/binaries/c5c1e31e4f6ac4fc431cf20fe01460ec008329d0b7e757497852cc787556ba99crc32: 4A5D1663md5: 574a3592c32eb216dd587f9251eea990sha1: 17438599a6b3d38589344cfd43ea56c69e04401dsha256: c5c1e31e4f6ac4fc431cf20fe01460ec008329d0b7e757497852cc787556ba99sha512: a930786f05b663f1fba81bc4b50bbf3046b6c5c555e557b86af283d346c24c9a6f6518c422f94104d6e75e2bb15c68b148e5c7f0e657045c7e2b3c28edffd5bcssdeep: 768:friwm6O9pSeErhu5KMycl/KuHUJ9CwLa62:DiwIsRk5KcZKuKCwdtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1F2F29F20F2F9C5F4CAFD8F73586E6ED3157AF2368EE21E5F4AC490612AA340E8151B45sha3_384: b364b4a7157c9177b0095b1cbd3b8112078ade0bc89823c54c4721f5b35239f450dd5377786cb5bd665e7451d0983e42ep_bytes: ff250020400011000000000000000000timestamp: 2017-01-25 18:39:04
Version Info:
0: [No Data]

Ursu.113725 also known as:

Bkav	W32.AIDetectNet.01
Lionic	Trojan.MSIL.Hallaj.m!c
MicroWorld-eScan	Gen:Variant.Ursu.113725
FireEye	Generic.mg.574a3592c32eb216
ALYac	Gen:Variant.Ursu.113725
Cylance	Unsafe
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Trojan ( 0051a5cb1 )
Alibaba	Backdoor:MSIL/Kryptik.09d9b3ab
K7GW	Trojan ( 0051a5cb1 )
Cybereason	malicious.2c32eb
Arcabit	Trojan.Ursu.D1BC3D
VirIT	Trojan.Win32.Dnldr17.CZUM
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of MSIL/Kryptik.KQM
APEX	Malicious
Paloalto	generic.ml
Kaspersky	HEUR:Backdoor.MSIL.Generic
BitDefender	Gen:Variant.Ursu.113725
NANO-Antivirus	Trojan.Win32.Hallaj.ekowfg
Avast	Win32:CrypterX-gen [Trj]
Tencent	Msil.Backdoor.Hallaj.Suxu
Ad-Aware	Gen:Variant.Ursu.113725
Emsisoft	Gen:Variant.Ursu.113725 (B)
Comodo	Malware@#17j5zrshm9ec7
DrWeb	Trojan.DownLoader17.52584
McAfee-GW-Edition	BehavesLike.Win32.Generic.nc
Trapmine	malicious.high.ml.score
Sophos	Mal/Generic-S
SentinelOne	Static AI – Malicious PE
Jiangmin	Backdoor.MSIL.wes
Avira	HEUR/AGEN.1241447
Microsoft	Backdoor:MSIL/Bladabindi
ViRobot	Trojan.Win32.S.KeyLogger.36352.C
GData	Gen:Variant.Ursu.113725
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Bladabindi.C2262027
Acronis	suspicious
McAfee	GenericRXMT-EQ!574A3592C32E
MAX	malware (ai score=100)
VBA32	Backdoor.MSIL.Hallaj
Malwarebytes	Malware.AI.3717769947
Rising	Trojan.Generic/MSIL@AI.100 (RDM.MSIL:3Xqmt5nVK46rq1hYFwS9Mw)
Yandex	Backdoor.Hallaj!EMlK8AacB3g
Ikarus	Trojan.MSIL.Crypt
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	MSIL/Kryptik.GVM!tr
BitDefenderTheta	Gen:NN.ZemsilF.34742.cqW@aa@Hqgn
AVG	Win32:CrypterX-gen [Trj]
Panda	Trj/GdSda.A
CrowdStrike	win/malicious_confidence_100% (W)