Ursu.374778 removal

The Ursu.374778 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Ursu.374778 virus can do?

Executable code extraction
Creates RWX memory
Reads data out of its own binary image
Drops a binary and executes it
Network activity detected but not expressed in API logs

How to determine Ursu.374778?


File Info:
crc32: 1FE2EF6C
md5: fa31f426444a9b414892ae97856bf5d8
name: FA31F426444A9B414892AE97856BF5D8.mlw
sha1: eb4569ac5b8c53eaceaea37a9d64c9b6e7dfbdd1
sha256: 1dd6e380df29aa5d0ead5d4d07b42e3c8b867f1fd1d413685e563f5bb6610435
sha512: 1b86a11dc2a9a5412bc71e73b5aa623eddbe3d1f569862df07bfca73cf3fd2c7c443c22712a8f6517148b37617a878bbd60a83c11414592ab1251fdb3fd3393f
ssdeep: 12288:4yIF3jVtp/9fuL9XlGbNvPAT9VHQH/OOC7d0BRVvG9C+ZO:4yIlfplmL9EbNvIT9VHOxMuBRUq
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright:                                                                                                     
FileVersion:                     
CompanyName:                                                             
Comments: This installation was built with Inno Setup.
ProductName: LT                                                          
ProductVersion: v2                                                
FileDescription: LT Setup                                                    
Translation: 0x0000 0x04b0

Ursu.374778 also known as:

Elastic	malicious (high confidence)
DrWeb	Trojan.PWS.Stealer.24403
Cynet	Malicious (score: 99)
ALYac	Gen:Variant.Ursu.374778
Cylance	Unsafe
CrowdStrike	win/malicious_confidence_80% (D)
Alibaba	TrojanPSW:Win32/Coins.233d0ab5
Cybereason	malicious.6444a9
Symantec	Trojan.Gen.MBT
ESET-NOD32	a variant of Win32/Kryptik.GOWE
APEX	Malicious
Avast	Win32:Malware-gen
Kaspersky	Trojan-PSW.Win32.Coins.jva
BitDefender	Gen:Variant.Ursu.374778
NANO-Antivirus	Trojan.Win32.Coins.fiklui
MicroWorld-eScan	Gen:Variant.Ursu.374778
Tencent	Win32.Trojan-qqpass.Qqrob.Eddh
Sophos	Mal/Generic-S
BitDefenderTheta	Gen:NN.ZexaE.34266.Dq0@ayM3Msni
McAfee-GW-Edition	BehavesLike.Win32.AdwareFileTour.hc
FireEye	Gen:Variant.Ursu.374778
Emsisoft	Gen:Variant.Ursu.374778 (B)
SentinelOne	Static AI – Suspicious PE
Avira	HEUR/AGEN.1112397
Antiy-AVL	Trojan/Generic.ASMalwS.27F7DCA
Microsoft	Trojan:Win32/Occamy.C1D
GData	Gen:Variant.Ursu.374778
AhnLab-V3	Malware/Win32.Generic.C2710180
McAfee	Artemis!FA31F426444A
MAX	malware (ai score=99)
Malwarebytes	Malware.AI.3781874703
Panda	Trj/CI.A
Ikarus	Trojan.Win32.Krypt
Fortinet	W32/GenKryptik.CKKO!tr
AVG	Win32:Malware-gen
Paloalto	generic.ml

How to remove Ursu.374778?

Ursu.374778 removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X