What is “Ursu.307277”?

The Ursu.307277 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Ursu.307277 virus can do?

Executable code extraction
Compression (or decompression)
Creates RWX memory
Installs itself for autorun at Windows startup
Creates a hidden or system file
Network activity detected but not expressed in API logs

How to determine Ursu.307277?


File Info:
crc32: 5EBF8C33
md5: cc3c90f4bfe4fca9a608f0750ad395cb
name: CC3C90F4BFE4FCA9A608F0750AD395CB.mlw
sha1: 9949095f56bc073121df0a446c2f4eef0245339c
sha256: a4eaf7bf36e7225bd8aa75fe89ee2d434046aff7b30886ce0a054508ce8987af
sha512: 2f11dc26e41853747da87f08ee9cc265f7f66aab59a305cdbb2c6980d4186ee9d8e47ab213c605a1a00904d5d1b49d268a634f3fb6b3a7f7da47201770e34db9
ssdeep: 6144:TtqZ911rwJZ0HbWScQhobW2PisXhXE8t0ZG5ZwPCxSYS+:Tt81tho6cisRXVtVwPl+
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: Copyright xa9 Alexander Roshal 1993-2018
InternalName: WinRAR
FileVersion: 5.61.1
CompanyName: Alexander Roshal
ProductName: WinRAR
ProductVersion: 5.61.1
FileDescription: WinRAR archiver
OriginalFilename: WinRAR.exe
Translation: 0x0409 0x04e4

Ursu.307277 also known as:

Bkav	W32.AIDetect.malware1
K7AntiVirus	Trojan ( 0053dc591 )
Elastic	malicious (high confidence)
DrWeb	Trojan.PWS.Stealer.24890
Cynet	Malicious (score: 99)
CAT-QuickHeal	Trojan.Mauvaise.SL1
ALYac	Gen:Variant.Ursu.307277
Cylance	Unsafe
Zillya	Trojan.Coins.Win32.1293
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_90% (D)
Alibaba	TrojanPSW:Win32/Coins.3d5f8241
K7GW	Trojan ( 0053dc591 )
Cybereason	malicious.4bfe4f
Symantec	Trojan.Gen.MBT
ESET-NOD32	Win32/Kryptik.GLFM
Zoner	Trojan.Win32.70248
APEX	Malicious
Avast	Win32:Malware-gen
Kaspersky	Trojan-PSW.Win32.Coins.mdt
BitDefender	Gen:Variant.Ursu.307277
NANO-Antivirus	Trojan.Win32.Propagate.fincyb
MicroWorld-eScan	Gen:Variant.Ursu.307277
Tencent	Malware.Win32.Gencirc.10ba4a2f
Ad-Aware	Gen:Variant.Ursu.307277
Comodo	Malware@#ua6agwvflq62
BitDefenderTheta	Gen:NN.ZexaF.34692.qC0@aa2D5Cci
TrendMicro	TSPY_COINSTEAL.THAAOAAH
McAfee-GW-Edition	GenericRXGM-LZ!CC3C90F4BFE4
FireEye	Generic.mg.cc3c90f4bfe4fca9
Emsisoft	Gen:Variant.Ursu.307277 (B)
Jiangmin	Trojan.Propagate.avv
Webroot	W32.Trojan.Gen
Avira	HEUR/AGEN.1120609
Antiy-AVL	Trojan/Generic.ASMalwS.2840BF8
Microsoft	Ransom:Win32/Gandcrab!MTB
AegisLab	Trojan.Win32.Coins.4!c
GData	Gen:Variant.Ursu.307277
AhnLab-V3	Trojan/Win32.Inject.C2738576
McAfee	GenericRXGM-LZ!CC3C90F4BFE4
MAX	malware (ai score=100)
VBA32	TrojanPSW.Azorult
Panda	Trj/GdSda.A
TrendMicro-HouseCall	TSPY_COINSTEAL.THAAOAAH
Rising	Trojan.Generic@ML.81 (RDML:codvOnAmuGAIaBQlfjnBYA)
Yandex	Trojan.GenAsa!hQno6xIx3vg
Ikarus	Trojan.Win32.Crypt
Fortinet	W32/GenKryptik.CKDY!tr.ransom
AVG	Win32:Malware-gen
Paloalto	generic.ml

How to remove Ursu.307277?

Ursu.307277 removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X