Categories: Malware

Should I remove “Ursu.317548”?

The Ursu.317548 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Ursu.317548 virus can do?

Executable code extraction
Compression (or decompression)
Creates RWX memory
Unconventionial binary language: Russian
Unconventionial language used in binary resources: Russian
Attempts to modify proxy settings
Collects information to fingerprint the system
Anomalous binary characteristics

Related domains:

kapuapkope.lv

How to determine Ursu.317548?


File Info:
crc32: 29DF7C45md5: 96d9409d919e1f7b99e7cb2920b4aaa1name: 96D9409D919E1F7B99E7CB2920B4AAA1.mlwsha1: d60da8d6b85cadae61d5209a195ff74716be0a84sha256: c67cb1c3288c1eb143bc25c5f7f43085917bef125429504113abe4fc6b97d604sha512: 3ed23757a7f58231d69ac8ae2806a132c7c79e52e1e3b91dffb7cf8354b45c9724b20f10c4990b46dcfeb33477596033d98a216be5a0a847192b403cc4ec847dssdeep: 3072:O1P68FrwHN3wH6Hiokvw3NcesIq+9g5o9TKUVGwCXbO5pcH0T0j04+dysg49zn5:TcH0Uvw3Nc/Iq+9g5owbO5pcUwjcIntype: PE32 executable (GUI) Intel 80386, for MS Windows
Version Info:
LegalCopyright: Copyright xa9 2000InternalName: dmcrFileVersion: 1, 0, 0, 1CompanyName: -GSC-PrivateBuild: LegalTrademarks: Comments: ProductName: -GSC- dmcrSpecialBuild: ProductVersion: 1, 0, 0, 1FileDescription: dmcrOriginalFilename: dmcr.exeTranslation: 0x0419 0x04b0

Ursu.317548 also known as:

Bkav	W32.AIDetect.malware2
Lionic	Trojan.Win32.Coins.4!c
Elastic	malicious (high confidence)
ALYac	Gen:Variant.Ursu.317548
Cylance	Unsafe
Zillya	Trojan.Coins.Win32.1757
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_80% (D)
Alibaba	TrojanPSW:Win32/Coins.2cca35d3
K7GW	Trojan ( 0053fb461 )
K7AntiVirus	Trojan ( 0053fb461 )
Symantec	Trojan Horse
ESET-NOD32	a variant of Win32/Kryptik.GNHR
APEX	Malicious
Avast	Win32:Malware-gen
Cynet	Malicious (score: 100)
Kaspersky	Trojan-PSW.Win32.Coins.mrl
BitDefender	Gen:Variant.Ursu.317548
NANO-Antivirus	Trojan.Win32.Inject.fjawdl
MicroWorld-eScan	Gen:Variant.Ursu.317548
Tencent	Malware.Win32.Gencirc.1149278d
Ad-Aware	Gen:Variant.Ursu.317548
Sophos	Mal/Generic-R + Mal/Kryptik-CY
Comodo	Malware@#2hk2d7a9tvzgy
BitDefenderTheta	Gen:NN.ZexaF.34058.Iu0@aGEDhCbk
TrendMicro	Trojan.Win32.AZORULT.CBQ
McAfee-GW-Edition	Artemis!Trojan
FireEye	Generic.mg.96d9409d919e1f7b
Emsisoft	Gen:Variant.Ursu.317548 (B)
SentinelOne	Static AI – Suspicious PE
eGambit	Unsafe.AI_Score_81%
Microsoft	Ransom:Win32/Gandcrab!MTB
Arcabit	Trojan.Ursu.D4D86C
GData	Gen:Variant.Ursu.317548
AhnLab-V3	Win-Trojan/Gandcrab09.Exp
Acronis	suspicious
McAfee	Artemis!96D9409D919E
VBA32	Trojan.Inject
Malwarebytes	Trojan.Injector
Panda	Trj/GdSda.A
TrendMicro-HouseCall	Trojan.Win32.AZORULT.CBQ
Yandex	Trojan.GenAsa!z9dJbmjgUFs
Ikarus	Trojan.Win32.Injector
Fortinet	W32/GenKryptik.CKDY!tr.ransom
AVG	Win32:Malware-gen
Paloalto	generic.ml
Qihoo-360	Win32/Ransom.GandCrab.HwcBEpsA