Ursu.387828 information

The Ursu.387828 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Ursu.387828 virus can do?

CAPE extracted potentially suspicious content
Authenticode signature is invalid
Attempts to modify proxy settings
Harvests cookies for information gathering

How to determine Ursu.387828?


File Info:
name: 54CDA709E1317413ECD9.mlw
path: /opt/CAPEv2/storage/binaries/abbaadcbf12e30ecff30663eae8b799b48ef3a0c93843e4c1df13f26fd1b82e7
crc32: 2EA8DA08
md5: 54cda709e1317413ecd92b47c5469191
sha1: 0a9f0990907fdd55e3da1be98300da5f18a305fb
sha256: abbaadcbf12e30ecff30663eae8b799b48ef3a0c93843e4c1df13f26fd1b82e7
sha512: c5d35fd871e177f4568022ec4ba955d10e0a6896e18e217075f88f6a609fed9e8a29c0b2032813c26e789292fc673d4dabcebba3190a21b97b1e0d5c7930c77a
ssdeep: 768:XTluiBooWwuJTkTtz495wpltSi3bD7z2AefsAc6i:JprWXwb3bDX2AH
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T12133F812337C5127C7AD8AFB1471A302137AA62A6617F78C4CC265AE6DB77136B40F93
sha3_384: 73f133788af3e7285c2e985723fd30e09d7a43153b6ed00c87c959fb45e756d1b3a6bdc34f36fda70b136eaef0b584fa
ep_bytes: ff250020400000000000000000000000
timestamp: 2012-12-04 10:26:05

Version Info:
Translation: 0x0000 0x04b0
CompanyName: Microsoft
FileDescription: taskmgr
FileVersion: 1.0.0.0
InternalName: taskmgr.exe
LegalCopyright: Copyright © Microsoft 2012
OriginalFilename: taskmgr.exe
ProductName: taskmgr
ProductVersion: 1.0.0.0
Assembly Version: 1.0.0.0

Ursu.387828 also known as:

Bkav	W32.Common.7DE33C3E
Lionic	Trojan.Win32.Kazy.4!c
MicroWorld-eScan	Gen:Variant.Ursu.387828
FireEye	Gen:Variant.Ursu.387828
Cylance	Unsafe
Zillya	Trojan.Genome.Win32.231427
K7AntiVirus	Trojan ( 0056fe471 )
Alibaba	Trojan:MSIL/Generic.64351425
K7GW	Trojan ( 0056fe471 )
Cybereason	malicious.9e1317
BitDefenderTheta	Gen:NN.ZemsilF.34606.dm0@ayIIoUb
Symantec	Trojan.Gen.MBT
ESET-NOD32	a variant of MSIL/TrojanClicker.Agent.NAY
Paloalto	generic.ml
BitDefender	Gen:Variant.Ursu.387828
NANO-Antivirus	Trojan.Win32.Agent.behxms
Avast	MSIL:Agent-OS [Trj]
Tencent	Win32.Trojan.Downloader.Swvd
Ad-Aware	Gen:Variant.Ursu.387828
Emsisoft	Gen:Variant.Ursu.387828 (B)
Comodo	Malware@#14qrr2jkv1p8g
F-Secure	Trojan.TR/Downloader.Gen
VIPRE	Gen:Variant.Ursu.387828
McAfee-GW-Edition	Artemis!Trojan
Sophos	Mal/Generic-S
SentinelOne	Static AI – Suspicious PE
GData	Gen:Variant.Ursu.387828
Google	Detected
Avira	TR/Downloader.Gen
Arcabit	Trojan.Ursu.D5EAF4
Microsoft	Trojan:Win32/Wacatac.B!ml
VBA32	Trojan.MSIL.gen.a.5
ALYac	Gen:Variant.Ursu.387828
MAX	malware (ai score=83)
Malwarebytes	Generic.Malware/Suspicious
Rising	Trojan.Clicker-Agent!8.13 (CLOUD)
Ikarus	Trojan.MSIL.TrojanClicker
MaxSecure	Trojan.Malware.74459525.susgen
Fortinet	MSIL/TrojanClicker_Agent.NAY
AVG	MSIL:Agent-OS [Trj]
Panda	Trj/Agent.MIZ

How to remove Ursu.387828?

Ursu.387828 removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X