Categories: Malware

Ursu.270183 removal instruction

The Ursu.270183 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Ursu.270183 virus can do?

SetUnhandledExceptionFilter detected (possible anti-debug)
At least one process apparently crashed during execution
Sample contains Overlay data
Unconventionial binary language: Russian
Unconventionial language used in binary resources: Russian
Authenticode signature is invalid

How to determine Ursu.270183?


File Info:
name: 6281B22E7E77073D0824.mlwpath: /opt/CAPEv2/storage/binaries/7b5f695e33ad368da31bcf4bdd96392327081e4c659ef7cd9de4fe1317bbfabbcrc32: D2A3613Bmd5: 6281b22e7e77073d082484ff320ac643sha1: d78a91b3863fc990f071e46a2378872b49b95dd2sha256: 7b5f695e33ad368da31bcf4bdd96392327081e4c659ef7cd9de4fe1317bbfabbsha512: 28991e94f6fc6966831c7ad7c1ef98fa8081a9725723029ccd486f870374653af06d6761f3802b33e3e103a12a5c33419a541e31c1bc91f3d5ab13da4fd969e2ssdeep: 6144:XitEsb/o+27RMWqcLYrKycsdk2F+0mOUUd7s4nYiayol:XEd/o+27SWtYtVeARmK7stype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1AE54C004F690C036F5D602F38AFE9FBDB629FA31035015C783E459AAA7656F4693324Bsha3_384: f549d4fd4f98d3cb27b205f5425e5ac670e5e1167ad7d84aac7c0476b14122e123b6146b115e710a748aae098c207fbaep_bytes: 558bec6aff68f8ca410068101b410064timestamp: 2018-08-12 19:30:39
Version Info:
FileDescription: eeeeeeeeeeeeeeeeeeeeeeeeeeeFileVersion: eeeeeeeeeeeeeeeeeeeeInternalName: eeeeeeeeeeeeeeeeeeeeeeeeeeeLegalCopyright: eeeeeeeeeeeeeeeeeeeeeeeeLegalTrademarks: eeeeeeeeeeeeeeeeeeeeeeeeeeeeeOriginalFilename: eeeeeeeeeeeeeeeeeeeeePrivateBuild: eeeProductName: eeeeeeeeeeeeeeeeeeeeProductVersion: eeeeeeeeeeeeeeeTranslation: 0x0419 0x04b0

Ursu.270183 also known as:

Bkav	W32.AIDetect.malware2
Lionic	Trojan.Win32.Coins.4!c
MicroWorld-eScan	Gen:Variant.Ursu.270183
FireEye	Generic.mg.6281b22e7e77073d
McAfee	Artemis!6281B22E7E77
Cylance	Unsafe
VIPRE	Gen:Variant.Ursu.270183
Sangfor	Infostealer.Win32.Coins.gqx
K7AntiVirus	Trojan ( 0053a5071 )
Alibaba	TrojanPSW:Win32/Coins.fe9a2fae
K7GW	Trojan ( 0053a5071 )
Cybereason	malicious.e7e770
BitDefenderTheta	Gen:NN.ZexaF.34786.rq3@aibahEfc
Cyren	W32/Trojan.HLSF-1607
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/Kryptik.GKAR
Paloalto	generic.ml
ClamAV	Win.Malware.Generic-6689119-0
Kaspersky	Trojan-PSW.Win32.Coins.gqx
BitDefender	Gen:Variant.Ursu.270183
NANO-Antivirus	Trojan.Win32.GenKryptik.fgowaz
Avast	Win32:Malware-gen
Tencent	Malware.Win32.Gencirc.114d1f30
Ad-Aware	Gen:Variant.Ursu.270183
Emsisoft	Gen:Variant.Ursu.270183 (B)
Comodo	Malware@#4zkwk3ipnv7m
Zillya	Trojan.Fareit.Win32.27630
McAfee-GW-Edition	BehavesLike.Win32.Dropper.dc
Sophos	Mal/Generic-S
Ikarus	Trojan.Win32.Krypt
GData	Gen:Variant.Ursu.270183
Jiangmin	Trojan.PSW.Fareit.upr
Avira	HEUR/AGEN.1240849
Antiy-AVL	Trojan/Generic.ASMalwS.502D
ZoneAlarm	Trojan-PSW.Win32.Coins.gqx
Microsoft	Trojan:Win32/Occamy.C7B
Cynet	Malicious (score: 100)
AhnLab-V3	Malware/Win32.Generic.C2666033
VBA32	BScope.TrojanPSW.Fareit
ALYac	Gen:Variant.Ursu.270183
Malwarebytes	Spyware.Pony
APEX	Malicious
Rising	Trojan.Generic@AI.88 (RDML:IxCkf+doDUxkJSW60CzBLA)
SentinelOne	Static AI – Malicious PE
Fortinet	W32/Generic.AC.41D165
AVG	Win32:Malware-gen
Panda	Trj/GdSda.A
CrowdStrike	win/malicious_confidence_90% (W)