Ursu.615555 malicious file

The Ursu.615555 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Ursu.615555 virus can do?

Attempts to connect to a dead IP:Port (5 unique times)
Performs some HTTP requests
Unconventionial binary language: Chinese (Simplified)
Unconventionial language used in binary resources: Chinese (Simplified)
Uses Windows utilities for basic functionality
Sniffs keystrokes
Attempts to modify proxy settings
The sample wrote data to the system hosts file.

Related domains:

z.whorecord.xyz

a.tomx.xyz

ymdwgame.ink

amos.alicdn.com

img.alicdn.com

img04.taobaocdn.com

ocsp.globalsign.com

How to determine Ursu.615555?


File Info:
crc32: 0CE1F4CE
md5: 769a9c2e8a8909336dcb2d325772098a
name: 1_____________________.exe
sha1: c8db7ea0148e14118d261b33a2d2a88e13d7e954
sha256: ec17a732e678ba84dd7d8b3c8a8ad468cc3541a1fc80e602b1dc79733b0340f6
sha512: 2fdf0b3065bc31cdd539beecf7ba7da7eab2209c185ec02cd9b36d614cb51eaada8d124ca42c6285c58e592b9d873933df27da37f678650f431663493a7f4ef9
ssdeep: 24576:pRDTylTT2QDWgq9+22WyQ1cqa2aDd0GYMFT1JbnWKzorPJkPjCiTerhdGUWnDvIw:pvu9Y0nWdt0jCYerbOnDvIqErble
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: x6781x901fx6e38x620fx7ba1x7406x5668
FileVersion: 1.1.0.0
CompanyName: x6781x901fx6e38x620fx7ba1x7406x5668
Comments: x6781x901fx6e38x620fx7ba1x7406x5668
ProductName: 1x6781x901fx6e38x620fx7ba1x7406x5668
ProductVersion: 1.1.0.0
FileDescription: x6781x901fx6e38x620fx7ba1x7406x5668
Translation: 0x0804 0x04b0

Ursu.615555 also known as:

Bkav	W32.AIDetectVM.malware
MicroWorld-eScan	Gen:Variant.Ursu.615555
FireEye	Generic.mg.769a9c2e8a890933
CAT-QuickHeal	Trojan.Diztakun.16490
McAfee	Artemis!769A9C2E8A89
Cylance	Unsafe
K7AntiVirus	Trojan ( 005246d51 )
BitDefender	Gen:Variant.Ursu.615555
K7GW	Trojan ( 005246d51 )
Cybereason	malicious.e8a890
Invincea	heuristic
F-Prot	W32/Trojan.CLL.gen!Eldorado
APEX	Malicious
GData	Gen:Variant.Ursu.615555
Rising	Malware.Heuristic!ET#97% (RDMK:cmRtazoRF+c/okmmQIEx7g6uzZwM)
Endgame	malicious (high confidence)
Emsisoft	Gen:Variant.Ursu.615555 (B)
Comodo	Backdoor.Win32.SkSocket.AD@5t7qie
DrWeb	Trojan.Hosts.47101
McAfee-GW-Edition	BehavesLike.Win32.Generic.vh
Cyren	W32/Trojan.CLL.gen!Eldorado
Jiangmin	TrojanDownloader.Upatre.agsy
MAX	malware (ai score=84)
Antiy-AVL	GrayWare/Win32.FlyStudio.a
Microsoft	Trojan:Win32/Detplock
Arcabit	Trojan.Ursu.D96483
Acronis	suspicious
BitDefenderTheta	Gen:NN.ZexaF.34082.Ks0@aWEC4KjH
ALYac	Gen:Variant.Ursu.615555
VBA32	BScope.Trojan.Packed
Malwarebytes	RiskWare.FlyStudio
ESET-NOD32	a variant of Win32/Packed.FlyStudio.AA potentially unwanted
TrendMicro-HouseCall	TROJ_GEN.R01FH0CAH20
SentinelOne	DFI – Malicious PE
eGambit	HackTool.Generic
Fortinet	W32/QQPass.ELG!tr.pws
Ad-Aware	Gen:Variant.Ursu.615555
Paloalto	generic.ml
CrowdStrike	win/malicious_confidence_100% (D)
Qihoo-360	Generic/Trojan.ca5

How to remove Ursu.615555?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Ursu.615555 malicious file