About “Ursu.558250” infection

The Ursu.558250 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Ursu.558250 virus can do?

The binary likely contains encrypted or compressed data.

How to determine Ursu.558250?


File Info:
crc32: 01C36AED
md5: ebef2aa1d91924134b439cd62605753a
name: EBEF2AA1D91924134B439CD62605753A.mlw
sha1: eb1b42a6f0e638d8c92e1fbee8f028a197266df6
sha256: 6de2f58574d5ae332f19e383e834ab655df4dff3c9404572ba8e01af7752db21
sha512: 4a30581d6d120197e7c5a73df5b1a5843f13c7aad21548d1bde021d09f1531151fca485dfebff2e8b5fe30a66c0445a799ddef26483692bd69e83b3cda62ce1d
ssdeep: 768:vD7lfyGlvA6HysU2AZ84fpTNW7dOIWJo/rOT7BgjTTGtWLQ7vnrV:rRKavFau4FNWBOXJo2BiTTSWLQDx
type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

Version Info:
Translation: 0x0000 0x04b0
LegalCopyright: Copyright xa9  2020
Assembly Version: 1.0.0.0
InternalName: OneDrive.exe
FileVersion: 1.0.0.0
CompanyName: 
LegalTrademarks: 
Comments: 
ProductName: OneDrive
ProductVersion: 1.0.0.0
FileDescription: OneDrive
OriginalFilename: OneDrive.exe

Ursu.558250 also known as:

Elastic	malicious (high confidence)
ALYac	Gen:Variant.Ursu.558250
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_80% (D)
BitDefender	Gen:Variant.Ursu.558250
Cybereason	malicious.1d9192
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/ClipBanker.LR
APEX	Malicious
Cynet	Malicious (score: 100)
MicroWorld-eScan	Gen:Variant.Ursu.558250
Ad-Aware	Gen:Variant.Ursu.558250
Sophos	ML/PE-A
BitDefenderTheta	Gen:NN.ZemsilF.34678.cm0@aa2sShp
FireEye	Generic.mg.ebef2aa1d9192413
Emsisoft	Gen:Variant.Ursu.558250 (B)
SentinelOne	Static AI – Malicious PE
eGambit	Unsafe.AI_Score_99%
Arcabit	Trojan.Ursu.D884AA
GData	Gen:Variant.Ursu.558250
MAX	malware (ai score=85)

How to remove Ursu.558250?

Ursu.558250 removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X