About “Ursu.286821” infection

The Ursu.286821 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Ursu.286821 virus can do?

Dynamic (imported) function loading detected
CAPE extracted potentially suspicious content
Authenticode signature is invalid

How to determine Ursu.286821?


File Info:
name: DEDF515C36C412F899A5.mlw
path: /opt/CAPEv2/storage/binaries/b0927e15392b2de39bfdc01035a501bc271d7338612f2074a6ed021fd8fe10bc
crc32: D3317D8A
md5: dedf515c36c412f899a51dc22fb3de48
sha1: a9094dcf0bf696239dfefea98dbdf4d5ec79e4c8
sha256: b0927e15392b2de39bfdc01035a501bc271d7338612f2074a6ed021fd8fe10bc
sha512: 4da64e853d61d9f5fc60e57aecfa7b24153a587705e03dc64a4b248919e747d8cea063558a6accb4ac67b4d2de909a8ba53ae80448f8455c88a6966b8b746378
ssdeep: 1536:bLr4K01LY4vnIMb5KcYinR3BWxzoIfjlc+Q/HbjxCYcKqkSZZZ3gNxib:bL0KQMkvbSin9IWI7zQ/7jTcUURb
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T198A35B4FED699BB6C6894732C803171803F2DC17E1A6F6162FC934F51DB3A09CB49968
sha3_384: 6d64567079f171fb28627cd313dca00cc4c5fa283a73da50e8e4afe4d9ba60081d6d522cd4eb2e07961465fa2f24e314
ep_bytes: ff250020400000000000000000000000
timestamp: 2022-07-07 10:42:37

Version Info:
Translation: 0x0000 0x04b0
FileDescription: mama
FileVersion: 1.0.0.0
InternalName: mama.exe
LegalCopyright: Copyright ©  2022
OriginalFilename: mama.exe
ProductName: mama
ProductVersion: 1.0.0.0
Assembly Version: 1.0.0.0

Ursu.286821 also known as:

Bkav	W32.AIDetectNet.01
MicroWorld-eScan	Gen:Variant.Ursu.286821
FireEye	Generic.mg.dedf515c36c412f8
McAfee	RDN/Generic BackDoor
K7AntiVirus	Trojan ( 004eeae31 )
K7GW	Trojan ( 004eeae31 )
Cybereason	malicious.c36c41
Cyren	W32/ABRisk.RBGS-0136
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of MSIL/Kryptik.GBD
APEX	Malicious
Kaspersky	HEUR:Backdoor.MSIL.Bladabindi.gen
BitDefender	Gen:Variant.Ursu.286821
Avast	Win32:Malware-gen
Ad-Aware	Gen:Variant.Ursu.286821
Emsisoft	Gen:Variant.Ursu.286821 (B)
DrWeb	Trojan.MulDrop20.19234
VIPRE	Gen:Variant.Ursu.286821
TrendMicro	TROJ_GEN.R014C0PGA22
McAfee-GW-Edition	RDN/Generic BackDoor
Trapmine	malicious.moderate.ml.score
Sophos	Mal/Generic-S
SentinelOne	Static AI – Malicious PE
Avira	HEUR/AGEN.1235592
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
Arcabit	Trojan.Ursu.D46065
GData	MSIL.Backdoor.Bladabindi.E6U51C
Cynet	Malicious (score: 100)
ALYac	Gen:Variant.Ursu.286821
MAX	malware (ai score=86)
TrendMicro-HouseCall	TROJ_GEN.R014C0PGA22
Rising	Trojan.Generic/MSIL@AI.100 (RDM.MSIL:Mo9Cu/fHSfhOsE6CnojNBA)
Ikarus	Trojan-Dropper.MSIL.Agent
Fortinet	MSIL/Kryptik.GBD!tr
BitDefenderTheta	Gen:NN.ZemsilF.34786.gm0@aWyyRid
AVG	Win32:Malware-gen
CrowdStrike	win/malicious_confidence_100% (W)

How to remove Ursu.286821?

Ursu.286821 removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X