Should I remove “Ursu.349272”?

The Ursu.349272 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Ursu.349272 virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Guard pages use detected – possible anti-debugging.
• Dynamic (imported) function loading detected
• At least one IP Address, Domain, or File Name was found in a crypto call
• Enumerates the modules from a process (may be used to locate base addresses in process injection)
• Enumerates running processes
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Attempts to remove evidence of file being downloaded from the Internet
• Installs itself for autorun at Windows startup
• Exhibits behavior characteristics of BlackRemote/BlackRAT RAT
• Exhibits behavior characteristic of Nanocore RAT
• Collects information to fingerprint the system
• Anomalous binary characteristics

How to determine Ursu.349272?

File Info:
name: B1A9328B1B6EDB377CB6.mlw
path: /opt/CAPEv2/storage/binaries/82bdba5da54c5f77c976d6456d0a0e31c27b5a1a844355375c9df76ec7f30e06
crc32: F3212482
md5: b1a9328b1b6edb377cb6f679be2c9721
sha1: feca85fb9a3df617da42c6786c4f84ef38591e44
sha256: 82bdba5da54c5f77c976d6456d0a0e31c27b5a1a844355375c9df76ec7f30e06
sha512: 8e897533fa9c2def08c49572a4e916d77da8d388c18d44dfeb9a706c9b6f7c46b1ccf1713efef558d034069355e2e8571da096baf973459e26b3e965a7d3fd8c
ssdeep: 6144:JoM38iLGHMFqli7n20TOgXYVlF+1D1pwHuip70KdXWklEkJV7d5hUJYMSz/1:qMDGsFqluavpAwHuipwKfvV7tEYF
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1BA940207EFED3EC4C878537663FF97E4A628C8061436CB1E12D4120ABAAD5177A827D5
sha3_384: 5c5f6655502506a2aa36b451831fb267a7d70e37246342b8e3fa5daf6155afd93c2bb91bca0bfa3e19a8f3739a27abd3
ep_bytes: 83ec1cc7042402000000ff1530814100
timestamp: 1970-01-01 00:00:00

Version Info:
CompanyName: Microsoft Corporation
FileDescription: Internet Explorer ImpExp FF exporter
FileVersion: 11.00.9600.16428 (winblue_gdr.131013-1700)
InternalName: extexport
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFilename: extexport.exe
ProductName: Internet Explorer
ProductVersion: 11.00.9600.16428
OleSelfRegister: 
Translation: 0x0409 0x04b0

Ursu.349272 also known as:

How to remove Ursu.349272?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.