What is “Ursu.724975”?

The Ursu.724975 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Ursu.724975 virus can do?

Authenticode signature is invalid
Anomalous binary characteristics

How to determine Ursu.724975?


File Info:
name: 01A56B91E6BE8600D279.mlw
path: /opt/CAPEv2/storage/binaries/1f954911064d71b0458b016f2b4e6a3998b4be93101322a2d83f8336990fc4de
crc32: C2EC896A
md5: 01a56b91e6be8600d279a053e542681a
sha1: a8b1c28d3f6d977f9d2abf386197c57de67667a6
sha256: 1f954911064d71b0458b016f2b4e6a3998b4be93101322a2d83f8336990fc4de
sha512: f84c74cbfd93a0b80bbcdb881b80205529a7437c932b898ff9e438004910d919d5662d33e38687ee9215205ac7c4a5fd4f561af59b101e459f280b0c2c12e432
ssdeep: 12288:gP9+zE1Vn8y6eB/JzN44YkXsvwkZ3zCq6SX9kuLT2tN1w1f9V58Ve3CGKhIkmdq:gP9D1V/rzN44DGlz6S3MI978Vl6q
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T13F45CFCAD16E44D2DC053FF598242AC75B2447328BB400283A6FBD495F7B5FAC05EEA6
sha3_384: 0911b8f53a2ee606424cdc570d571742ad5deaa87029ba53faf905ea79c7a94a2c8dd8c462ddee262bf0950a07b3372b
ep_bytes: 68a4184000e8f0ffffff000000000000
timestamp: 2015-03-24 12:04:40

Version Info:
Translation: 0x0409 0x04b0
CompanyName: OFFICE
ProductName: AdobeUpdate
FileVersion: 11.00.0009
ProductVersion: 11.00.0009
InternalName: AdobeUpdate
OriginalFilename: AdobeUpdate.exe

Ursu.724975 also known as:

Bkav	W32.AIDetect.malware2
Lionic	Trojan.Multi.Generic.4!c
tehtris	Generic.Malware
MicroWorld-eScan	Gen:Variant.Ursu.724975
FireEye	Generic.mg.01a56b91e6be8600
McAfee	Artemis!01A56B91E6BE
Cylance	Unsafe
Zillya	Trojan.Agent.Win32.585922
Sangfor	[MICROSOFT VISUAL BASIC 5.0]
K7AntiVirus	Spyware ( 004d53c91 )
Alibaba	TrojanSpy:Win32/Generic.b90349aa
K7GW	Spyware ( 004d53c91 )
Cybereason	malicious.1e6be8
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	Win32/Spy.Agent.OTJ
APEX	Malicious
Paloalto	generic.ml
Cynet	Malicious (score: 99)
Kaspersky	UDS:DangerousObject.Multi.Generic
BitDefender	Gen:Variant.Ursu.724975
NANO-Antivirus	Trojan.Win32.Agent.ebjjba
Avast	Win32:Malware-gen
Tencent	Win32.Trojan.Spy.Een
Ad-Aware	Gen:Variant.Ursu.724975
Emsisoft	Gen:Variant.Ursu.724975 (B)
VIPRE	Gen:Variant.Ursu.724975
McAfee-GW-Edition	BehavesLike.Win32.Trojan.tt
Trapmine	malicious.moderate.ml.score
Sophos	ML/PE-A
SentinelOne	Static AI – Malicious PE
Avira	TR/Spy.Agent.1232896.79
Microsoft	TrojanSpy:Win32/Skeeyah.A!rfn
Arcabit	Trojan.Ursu.DB0FEF
GData	Gen:Variant.Ursu.724975
Google	Detected
ALYac	Gen:Variant.Ursu.724975
MAX	malware (ai score=99)
Rising	Spyware.Agent!8.C6 (TFE:5:UVHZH8idiAU)
Yandex	Trojan.GenAsa!v/DqJYxylcs
Ikarus	Trojan-Spy.Agent
MaxSecure	Trojan.Malware.74757689.susgen
Fortinet	W32/VBKrypt.C!tr
AVG	Win32:Malware-gen
Panda	Trj/GdSda.A
CrowdStrike	win/malicious_confidence_100% (W)

How to remove Ursu.724975?

Ursu.724975 removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X