Categories: Malware

Ursu.615555 malicious file

The Ursu.615555 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Ursu.615555 virus can do?

Attempts to connect to a dead IP:Port (5 unique times)
Performs some HTTP requests
Unconventionial binary language: Chinese (Simplified)
Unconventionial language used in binary resources: Chinese (Simplified)
Uses Windows utilities for basic functionality
Sniffs keystrokes
Attempts to modify proxy settings
The sample wrote data to the system hosts file.

Related domains:

z.whorecord.xyz

a.tomx.xyz

ymdwgame.ink

amos.alicdn.com

img.alicdn.com

img04.taobaocdn.com

ocsp.globalsign.com

How to determine Ursu.615555?


File Info:
crc32: 0CE1F4CEmd5: 769a9c2e8a8909336dcb2d325772098aname: 1_____________________.exesha1: c8db7ea0148e14118d261b33a2d2a88e13d7e954sha256: ec17a732e678ba84dd7d8b3c8a8ad468cc3541a1fc80e602b1dc79733b0340f6sha512: 2fdf0b3065bc31cdd539beecf7ba7da7eab2209c185ec02cd9b36d614cb51eaada8d124ca42c6285c58e592b9d873933df27da37f678650f431663493a7f4ef9ssdeep: 24576:pRDTylTT2QDWgq9+22WyQ1cqa2aDd0GYMFT1JbnWKzorPJkPjCiTerhdGUWnDvIw:pvu9Y0nWdt0jCYerbOnDvIqErbletype: PE32 executable (GUI) Intel 80386, for MS Windows
Version Info:
LegalCopyright: x6781x901fx6e38x620fx7ba1x7406x5668FileVersion: 1.1.0.0CompanyName: x6781x901fx6e38x620fx7ba1x7406x5668Comments: x6781x901fx6e38x620fx7ba1x7406x5668ProductName: 1x6781x901fx6e38x620fx7ba1x7406x5668ProductVersion: 1.1.0.0FileDescription: x6781x901fx6e38x620fx7ba1x7406x5668Translation: 0x0804 0x04b0

Ursu.615555 also known as:

Bkav	W32.AIDetectVM.malware
MicroWorld-eScan	Gen:Variant.Ursu.615555
FireEye	Generic.mg.769a9c2e8a890933
CAT-QuickHeal	Trojan.Diztakun.16490
McAfee	Artemis!769A9C2E8A89
Cylance	Unsafe
K7AntiVirus	Trojan ( 005246d51 )
BitDefender	Gen:Variant.Ursu.615555
K7GW	Trojan ( 005246d51 )
Cybereason	malicious.e8a890
Invincea	heuristic
F-Prot	W32/Trojan.CLL.gen!Eldorado
APEX	Malicious
GData	Gen:Variant.Ursu.615555
Rising	Malware.Heuristic!ET#97% (RDMK:cmRtazoRF+c/okmmQIEx7g6uzZwM)
Endgame	malicious (high confidence)
Emsisoft	Gen:Variant.Ursu.615555 (B)
Comodo	Backdoor.Win32.SkSocket.AD@5t7qie
DrWeb	Trojan.Hosts.47101
McAfee-GW-Edition	BehavesLike.Win32.Generic.vh
Cyren	W32/Trojan.CLL.gen!Eldorado
Jiangmin	TrojanDownloader.Upatre.agsy
MAX	malware (ai score=84)
Antiy-AVL	GrayWare/Win32.FlyStudio.a
Microsoft	Trojan:Win32/Detplock
Arcabit	Trojan.Ursu.D96483
Acronis	suspicious
BitDefenderTheta	Gen:NN.ZexaF.34082.Ks0@aWEC4KjH
ALYac	Gen:Variant.Ursu.615555
VBA32	BScope.Trojan.Packed
Malwarebytes	RiskWare.FlyStudio
ESET-NOD32	a variant of Win32/Packed.FlyStudio.AA potentially unwanted
TrendMicro-HouseCall	TROJ_GEN.R01FH0CAH20
SentinelOne	DFI – Malicious PE
eGambit	HackTool.Generic
Fortinet	W32/QQPass.ELG!tr.pws
Ad-Aware	Gen:Variant.Ursu.615555
Paloalto	generic.ml
CrowdStrike	win/malicious_confidence_100% (D)
Qihoo-360	Generic/Trojan.ca5