What is "Ursu.720270"? – Adware Reports

The Ursu.720270 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Ursu.720270 virus can do?

Creates RWX memory
A process attempted to delay the analysis task.
Performs some HTTP requests
Unconventionial binary language: Chinese (Simplified)
Unconventionial language used in binary resources: Chinese (Simplified)
The binary likely contains encrypted or compressed data.
The executable is compressed using UPX
Attempts to modify proxy settings

Related domains:

z.whorecord.xyz

a.tomx.xyz

www.cmsoft.cn

How to determine Ursu.720270?


File Info:
crc32: 4F420076
md5: 5a45e2141c4467969bce634e11596d64
name: 5A45E2141C4467969BCE634E11596D64.mlw
sha1: feac842ec9a0b820dde824e49339ce0a74d2e639
sha256: ed22d83a28e4d6e3af8de34965d3dd77ac690e8b303053f988799d6658f1307b
sha512: 12197b71f43e13ccb7ee94e58c739b999bea826d380c0d942c35cf29f362ec8643c5080f27d7ba169737b79b7338b1eb5e13865a4bfe4bf8a4c98b0a18833d9f
ssdeep: 12288:uZfdkoyNvguW7VtO1HEyc9K+6HSCA3RNrnsrL1W3oS:SN+Wu1HEy7dyzns1W
type: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed

Version Info:
LegalCopyright: x91cex4ebax5bb6x56ed CMSOFT.CN
InternalName: 
FileVersion: 1.0.0.138
CompanyName: x91cex4ebax5bb6x56ed
LegalTrademarks: 
Comments: x91cex4ebax5bb6x56edx51fax54c1
ProductName: x7f51x7edcx8c03x8bd5x52a9x624b
ProductVersion: 1.0.0.0
FileDescription: x7f51x7edcx8c03x8bd5x52a9x624b NetAssist
OriginalFilename: NetAssist
Translation: 0x0804 0x03a8

Ursu.720270 also known as:

MicroWorld-eScan	Gen:Variant.Ursu.720270
FireEye	Gen:Variant.Ursu.720270
APEX	Malicious
BitDefender	Gen:Variant.Ursu.720270
Ad-Aware	Gen:Variant.Ursu.720270
Comodo	Packed.Win32.MUPX.Gen@24tbus
Arcabit	Trojan.Ursu.DAFD8E
GData	Gen:Variant.Ursu.720270
MAX	malware (ai score=89)

How to remove Ursu.720270?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

What is “Ursu.720270”?