Should I remove “Ursu.157596”?

The Ursu.157596 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Ursu.157596 virus can do?

Dynamic (imported) function loading detected
CAPE extracted potentially suspicious content
.NET file is packed/obfuscated with Confuser
Authenticode signature is invalid

How to determine Ursu.157596?


File Info:
name: 308BF197386265B6DE86.mlw
path: /opt/CAPEv2/storage/binaries/0a4ec1aabbf76caf05e99cd2fc566d2ca8e0440dfc947084fdcc1dab0af938b0
crc32: 17AF7A03
md5: 308bf197386265b6de86b22eb6d3c4e8
sha1: d98c9234b91b21c364a5992bf6ca97ae5770196e
sha256: 0a4ec1aabbf76caf05e99cd2fc566d2ca8e0440dfc947084fdcc1dab0af938b0
sha512: 11211c9fde5256584536daeecc39361e957c24850572c9387b4673262842e5753a0b2400af9f5cea8683c4093f620c099f2e2b48cfd82f9aed72e5dbebc62c59
ssdeep: 1536:2cfr4H1n1cbVa9MV74MeMQlD0baRYX2NCancRuLV:2cfr4H1n1cpTx3U0baRYX2NCancRuLV
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T19673847B16D93F92E5BD537813B3129483FADE209203E71D2EE4706544BB346BA236C6
sha3_384: 2e2bbdfadacf0020f9c8603a8706ec8a69beeababa5a4e3e9841decdd973017d1ed0236f739e782153d60db202d7574e
ep_bytes: ff250020400000000000000000000000
timestamp: 2022-01-07 00:12:45

Version Info:
Translation: 0x0000 0x04b0
FileDescription: WindowsApplication1
FileVersion: 1.0.0.0
InternalName: WindowsApplication1.exe
LegalCopyright: Copyright ©  2022
OriginalFilename: WindowsApplication1.exe
ProductName: WindowsApplication1
ProductVersion: 1.0.0.0
Assembly Version: 1.0.0.0

Ursu.157596 also known as:

Elastic	malicious (high confidence)
ALYac	Gen:Variant.Ursu.157596
CrowdStrike	win/malicious_confidence_80% (D)
BitDefender	Gen:Variant.Ursu.157596
Cyren	W32/S-8931d031!Eldorado
ESET-NOD32	a variant of MSIL/Kryptik.NVC
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	VHO:Backdoor.MSIL.Bladabindi.gen
MicroWorld-eScan	Gen:Variant.Ursu.157596
Ad-Aware	Gen:Variant.Ursu.157596
Emsisoft	Gen:Variant.Ursu.157596 (B)
DrWeb	Trojan.DownLoader21.32497
FireEye	Generic.mg.308bf197386265b6
Sophos	Generic ML PUA (PUA)
GData	Gen:Variant.Ursu.157596
Jiangmin	TrojanDropper.Agent.bjjx
Avira	HEUR/AGEN.1117398
MAX	malware (ai score=81)
Arcabit	Trojan.Ursu.D2679C
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
Acronis	suspicious
Cylance	Unsafe
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	MSIL/GenKryptik.BYNI!tr
BitDefenderTheta	Gen:NN.ZemsilF.34114.em0@aW4m49j
Cybereason	malicious.738626

How to remove Ursu.157596?

Ursu.157596 removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X