Categories: Malware

About “Ursu.460497” infection

The Ursu.460497 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Ursu.460497 virus can do?

Creates RWX memory
Drops a binary and executes it
Unconventionial language used in binary resources: Arabic (Egypt)
The binary likely contains encrypted or compressed data.
The executable is compressed using UPX
Network activity detected but not expressed in API logs
Anomalous binary characteristics
Uses suspicious command line tools or Windows utilities

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine Ursu.460497?


File Info:
crc32: 5EB2E6BDmd5: 08812a91e266e530c1157c733884cc5dname: 08812A91E266E530C1157C733884CC5D.mlwsha1: 93502cc7068160b465bff29604ee3e01a0d57d4asha256: 599873d459af8cce8192d01eb75019459337c9538bcfc26e5331c38a63b87dccsha512: 148a18424c0bcc59d034cf0300e6e45edbd2203d8d5d6f932647cf297b2004b38911ab41a537ee0e381d4906b09b8c941f7f5ddbdf75c334388bd25ecbee6b45ssdeep: 24576:MkcDblJQxdc5ZcGWIs0Ay91fVhEBaRzni3USj:MxblJQccdNUThEBaN0Utype: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Version Info:
LegalCopyright: (C) 2016 philandro Software GmbHFileVersion: 4.3.0.0CompanyName: philandro Software GmbHProductName: AnyDeskProductVersion: 4.3FileDescription: AnyDeskTranslation: 0x0000 0x04e4

Ursu.460497 also known as:

Bkav	W32.AIDetect.malware2
Lionic	Trojan.Win32.Stealer.l!c
Elastic	malicious (high confidence)
DrWeb	Trojan.Remcos.3
ClamAV	Win.Trojan.Agent-7779300-0
CAT-QuickHeal	TrojanSpy.Stealer
ALYac	Spyware.Infostealer.Azorult
Cylance	Unsafe
Zillya	Trojan.Stealer.Win32.6066
Sangfor	Trojan.Win32.Azorult.DS!MTB
CrowdStrike	win/malicious_confidence_90% (W)
Alibaba	TrojanSpy:Win32/Stealer.67420940
K7GW	Trojan ( 7000000f1 )
K7AntiVirus	Trojan ( 7000000f1 )
Cyren	W32/Delf.YACU-3578
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Injector.EFPU
APEX	Malicious
Avast	FileRepMalware
Cynet	Malicious (score: 100)
Kaspersky	HEUR:Trojan-Spy.Win32.Stealer.gen
BitDefender	Gen:Variant.Ursu.460497
NANO-Antivirus	Trojan.Win32.Inject.fqoovo
MicroWorld-eScan	Gen:Variant.Ursu.460497
Tencent	Win32.Trojan-spy.Stealer.Gbp
Ad-Aware	Gen:Variant.Ursu.460497
Sophos	Mal/Generic-S + Troj/Delf-HKU
BitDefenderTheta	Gen:NN.ZelphiF.34170.7mKfaKG0fonK
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TROJ_GEN.R002C0PII21
McAfee-GW-Edition	GenericR-QDJ!165ED6272765
FireEye	Generic.mg.08812a91e266e530
Emsisoft	Gen:Variant.Ursu.460497 (B)
SentinelOne	Static AI – Suspicious PE
Jiangmin	TrojanSpy.Stealer.bhx
Webroot	W32.Trojan.Gen
Avira	PUA/InstallCore.Gen
eGambit	Unsafe.AI_Score_91%
Antiy-AVL	Trojan/Generic.ASMalwS.2BA6281
Microsoft	PWS:Win32/Stimilina.E!rfn
Arcabit	Trojan.Ursu.D706D1
GData	Gen:Variant.Ursu.460497
AhnLab-V3	Malware/Win32.RL_Generic.R273800
McAfee	Artemis!08812A91E266
MAX	malware (ai score=99)
VBA32	Trojan.Inject
Malwarebytes	Trojan.MalPack.SMY.Generic
Panda	Trj/CI.A
TrendMicro-HouseCall	TROJ_GEN.R002C0PIP21
Yandex	Trojan.GenAsa!174kSYp7KP0
Ikarus	Trojan.Inject
MaxSecure	Trojan.Malware.73793603.susgen
Fortinet	W32/GenKryptik.EKLE!tr
AVG	FileRepMalware
Paloalto	generic.ml