Malware

About “Ursu.727801” infection

Malware Removal

The Ursu.727801 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Ursu.727801 virus can do?

  • Executable code extraction
  • A process attempted to delay the analysis task.
  • Attempts to connect to a dead IP:Port (20 unique times)
  • Reads data out of its own binary image
  • Performs some HTTP requests
  • Exhibits possible ransomware file modification behavior
  • Anomalous binary characteristics

Related domains:

koxp.alcazer.com
apps.identrust.com
crl.identrust.com
x1.c.lencr.org
r3.o.lencr.org
www.facebook.com
www.google-analytics.com
s10.histats.com
ocsp.digicert.com
ocsp.pki.goog
crls.pki.goog
ssl.google-analytics.com
static.xx.fbcdn.net
whos.amung.us
s4.histats.com

How to determine Ursu.727801?


File Info:

crc32: AEABF585
md5: e43094e6d068c0a5a1f5feb482ccf11d
name: E43094E6D068C0A5A1F5FEB482CCF11D.mlw
sha1: b48206f2587964f3f37041ac1b5346dce1b4c90f
sha256: dd4eeeb16d8d54defa69cbc7808d11c3e36306179e31497bbc86c09d538884b5
sha512: 5286ed0624b37b8516324caeaeb5f8fe03aac7783e2a362fbe8069a766a0be2e2d09f2d1e966f9235305a8d6e5c984638007b0583161fcd1e3bc39edca10ca06
ssdeep: 1536:lrEPDxxxxxxxxxxxxxxxxxxxxx6lnz+eYj8ZR8OywQNCaeFWk8qbsZao2:xEbxxxxxxxxxxxxxxxxxxxxx6lnaj8ZF
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

Translation: 0x0409 0x04b0
InternalName: 0yunMac
FileVersion: 20.01.0009
CompanyName: http://koxp.alcazer.com
ProductName: x11fx15fx130tutIxe7xf6
ProductVersion: 20.01.0009
FileDescription: Dxf8xd7txf8rxd7 xa9opyright 2013
OriginalFilename: 0yunMac.exe

Ursu.727801 also known as:

CynetMalicious (score: 99)
ALYacGen:Variant.Ursu.727801
CylanceUnsafe
SangforTrojan.Win32.Save.a
AlibabaTrojan:Win32/Keylogger.f3181c8c
Cybereasonmalicious.6d068c
SymantecDownloader
APEXMalicious
AvastWin32:Malware-gen
ClamAVWin.Trojan.Generic-7586366-0
KasperskyUDS:DangerousObject.Multi.Generic
BitDefenderGen:Variant.Ursu.727801
MicroWorld-eScanGen:Variant.Ursu.727801
Ad-AwareGen:Variant.Ursu.727801
SophosGeneric PUA LE (PUA)
ComodoMalware@#3245sz415ul7z
VIPRETrojan.Win32.Generic.pak!cobra
McAfee-GW-EditionBehavesLike.Win32.Trojan.mm
FireEyeGeneric.mg.e43094e6d068c0a5
EmsisoftGen:Variant.Ursu.727801 (B)
WebrootTrojan.Downloader.Gen
AviraTR/VB.Downloader.Gen
Antiy-AVLTrojan/Generic.ASMalwS.28471A2
KingsoftWin32.Troj.Undef.(kcloud)
MicrosoftTrojan:Win32/Wacatac.B!ml
ArcabitTrojan.Ursu.DB1AF9
GDataGen:Variant.Ursu.727801
McAfeeArtemis!E43094E6D068
MalwarebytesMalware.AI.3690144103
PandaTrj/CI.A
Ikarusnot-a-virus:Monitor.Win32.Keylogger
AVGWin32:Malware-gen
Paloaltogeneric.ml

How to remove Ursu.727801?

Ursu.727801 removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment