Categories: Malware

About “Ursu.444204” infection

The Ursu.444204 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Ursu.444204 virus can do?

Executable code extraction
Creates RWX memory
Repeatedly searches for a not-found process, may want to run with startbrowser=1 option
The binary likely contains encrypted or compressed data.
The executable is likely packed with VMProtect
Tries to suspend Cuckoo threads to prevent logging of malicious activity
Anomalous binary characteristics

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine Ursu.444204?


File Info:
crc32: 4ADC2E9Emd5: 9fccf8596457cbea3050aa45a92a4911name: file_save.exesha1: f2e9614af7ef9dbee19f9695fbcd055463478026sha256: b5679e6cdaeb67738ea6426fe4c779adfbdfe05109fdb24f92c0041fed3755e2sha512: 19a0016f285508aaaa40f1b00fa2cb8e20750172e945c574213388501f1fc6f295b021fb1d4bae856e7f78b1510e5e556d4b8f2ade1115a3bb1e2cef13937eecssdeep: 196608:fA5AXAs/dn8PTKpQe3wa69uCumymcKTW:XXAs/dIoQeZ69BFRcBtype: PE32 executable (GUI) Intel 80386, for MS Windows
Version Info:
ProductVersion: 1.0.0.0ProductName: File SaveFileVersion: 1.0.0.0CompanyName: File SaveTranslation: 0x0409 0x04e4

Ursu.444204 also known as:

MicroWorld-eScan	Gen:Variant.Ursu.444204
FireEye	Generic.mg.9fccf8596457cbea
McAfee	Artemis!9FCCF8596457
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
K7AntiVirus	Trojan ( 004046cf1 )
BitDefender	Gen:Variant.Ursu.444204
K7GW	Trojan ( 004046cf1 )
Cybereason	malicious.96457c
Invincea	heuristic
Baidu	Win32.Packed.VMProtect.a
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
GData	Gen:Variant.Ursu.444204
Kaspersky	not-a-virus:AdWare.Win32.InstallDisck.c
Alibaba	AdWare:Win32/InstallDisck.813d0c40
NANO-Antivirus	Trojan.Win32.Black.gfpulx
AegisLab	Trojan.Win32.Ursu.4!c
Rising	Trojan.Generic@ML.95 (RDML:+mRlqTErd438tRJhCyvYkg)
Endgame	malicious (high confidence)
Sophos	Mal/VMProtBad-A
F-Secure	Trojan.TR/Black.Gen2
TrendMicro	TROJ_GEN.R002C0RK419
McAfee-GW-Edition	BehavesLike.Win32.Dropper.wc
Emsisoft	Gen:Variant.Ursu.444204 (B)
Ikarus	Trojan.Win32.VMProtect
Cyren	W32/Trojan.VHKO-1442
Avira	TR/Black.Gen2
MAX	malware (ai score=83)
Microsoft	Trojan:Win32/Occamy.C
Arcabit	Trojan.Ursu.D6C72C
ZoneAlarm	not-a-virus:AdWare.Win32.InstallDisck.c
ALYac	Gen:Variant.Ursu.444204
Panda	Trj/GdSda.A
ESET-NOD32	a variant of Win32/Packed.VMProtect.ABD
TrendMicro-HouseCall	TROJ_GEN.R002C0RK419
SentinelOne	DFI – Malicious PE
Fortinet	Adware/InstallDisck
Ad-Aware	Gen:Variant.Ursu.444204
AVG	FileRepMalware
Paloalto	generic.ml
CrowdStrike	win/malicious_confidence_90% (W)
Qihoo-360	Win32/Trojan.17b