Ursu.546450 malicious file

The Ursu.546450 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Ursu.546450 virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• NtSetInformationThread: attempt to hide thread from debugger
• Possible date expiration check, exits too soon after checking local time
• Enumerates the modules from a process (may be used to locate base addresses in process injection)
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• CAPE detected the EnigmaStub malware family
• Anomalous binary characteristics

How to determine Ursu.546450?

File Info:
name: EEBEEED53444974B4E7C.mlw
path: /opt/CAPEv2/storage/binaries/fb6f51976e572c779cce892ed49d948d07d7f1cc9932c088e6557deaef510ef6
crc32: 9231DC24
md5: eebeeed53444974b4e7cf5ad107aa590
sha1: 623ce04f877d71afe6423231db3432cdb71d9fe4
sha256: fb6f51976e572c779cce892ed49d948d07d7f1cc9932c088e6557deaef510ef6
sha512: 4c8e4ad680b48bbc577e7a1af69d84fe6b61ac528e258629c673051b6c1dfe1a680066a5ebc64748811a800e1b35cbbcac654f218bc27f646eb2a6876d6560fd
ssdeep: 24576:/Zoai09XDFrrYNh96Wu87N2aVptTmyl4epAcKmqAR1a9U3PKqrI77Dvk0g:WD09XDFrUNbfuWWepAjmEU3Pz4vk0
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T148353397E9AB173ED16450F02A8EDC50FA2C6B5B8D1C51E05AD029FE3F472861E0737A
sha3_384: 67466265f1390993da40bef7ae2bbc96389f566c75e5bd3bb3867abde7f1d96e64571956fdb2f751c86065949ffb8e4c
ep_bytes: 558bec83c4f0b800104000e801000000
timestamp: 2020-05-10 05:24:51

Version Info:
Translation: 0x0000 0x04b0
Comments: 
CompanyName: Microsoft Corporation
FileDescription: Host Process for Windows Services
FileVersion: 6.2.17763.1
InternalName: svchost.exe
LegalCopyright: © Microsoft Corporation. All rights reserved.
LegalTrademarks: 
OriginalFilename: svchost.exe
ProductName: Microsoft® Windows® Operating System
ProductVersion: 6.2.17763.1
Assembly Version: 6.2.17763.1

Ursu.546450 also known as:

How to remove Ursu.546450?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.