What is “Ursu.391171”?

The Ursu.391171 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Ursu.391171 virus can do?

The binary likely contains encrypted or compressed data.
Network activity detected but not expressed in API logs
Anomalous binary characteristics

How to determine Ursu.391171?


File Info:
crc32: 25AAD8E6
md5: 0a7c4d3e00285907574ed93105e7cbd0
name: 0A7C4D3E00285907574ED93105E7CBD0.mlw
sha1: f5acb2a4339b7c0adc7b952a28a6e25a550ace90
sha256: 0c5c72f6b371e157babb410027a947c70555a1f9bf4e1900664249f4d51e3290
sha512: 622c50dc8641170f9b32068e40759971095c324f85c35dd8cee6df60196f4d6390f3728820cf373a60d7b98e9402d3f00ef3cd15cfcfe9267e0bcf3d3bee231f
ssdeep: 12288:qdc17+4YPzAr2u/bdo8iY9ELcp/gT3CJLnUf4AbRsu:qde7VYP0r9Ddo8iYq4AbR
type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

Version Info:
Translation: 0x0000 0x04b0
LegalCopyright: Copyright xa9  2021
Assembly Version: 1.0.0.0
InternalName: WindowsFormsApp1.exe
FileVersion: 1.0.0.0
CompanyName: 
LegalTrademarks: 
Comments: 
ProductName: WindowsFormsApp1
ProductVersion: 1.0.0.0
FileDescription: WindowsFormsApp1
OriginalFilename: WindowsFormsApp1.exe

Ursu.391171 also known as:

K7AntiVirus	Trojan ( 004be61a1 )
Elastic	malicious (high confidence)
ClamAV	Win.Packed.Hpbladabi-6860330-0
ALYac	Gen:Variant.Ursu.391171
Sangfor	Suspicious.Win32.Save.a
CrowdStrike	win/malicious_confidence_70% (W)
K7GW	Trojan ( 004be61a1 )
Cybereason	malicious.e00285
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/Packed.Confuser.P suspicious
APEX	Malicious
Avast	Win32:Malware-gen
Cynet	Malicious (score: 100)
Kaspersky	VHO:Trojan-Ransom.Win32.Phnu.gen
BitDefender	Gen:Variant.Ursu.391171
MicroWorld-eScan	Gen:Variant.Ursu.391171
Ad-Aware	Gen:Variant.Ursu.391171
Sophos	Generic ML PUA (PUA)
BitDefenderTheta	Gen:NN.ZemsilF.34142.Iq0@aqENe7k
McAfee-GW-Edition	BehavesLike.Win32.Generic.hh
FireEye	Generic.mg.0a7c4d3e00285907
Emsisoft	Gen:Variant.Ursu.391171 (B)
SentinelOne	Static AI – Malicious PE
Avira	HEUR/AGEN.1112852
eGambit	Unsafe.AI_Score_99%
Antiy-AVL	Trojan/Generic.ASBOL.38BB
Microsoft	Backdoor:Win32/Bladabindi!ml
Gridinsoft	Trojan.Heur!.020130A1
GData	Gen:Variant.Ursu.391171
McAfee	Artemis!0A7C4D3E0028
MAX	malware (ai score=83)
TrendMicro-HouseCall	TROJ_GEN.R014H0CIG21
Ikarus	Trojan.MSIL.IRPlan
Fortinet	Riskware/Application
AVG	Win32:Malware-gen

How to remove Ursu.391171?

Ursu.391171 removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X