About “Ursu.728548” infection

The Ursu.728548 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Ursu.728548 virus can do?

Executable code extraction
Creates RWX memory
Anomalous binary characteristics

How to determine Ursu.728548?


File Info:
crc32: F53E435D
md5: 93185dbdeba8ddee862654e176ab7a15
name: 93185DBDEBA8DDEE862654E176AB7A15.mlw
sha1: 56cb27b3d31a56b18c24c9785667bd727b825aaf
sha256: 5a43ae9700e9d014567ad1a6cba58e11e6957b7053572a0a80e2f0487597da64
sha512: 38c80c56edc53908dfd766b73aff283d68efffcfc3ceb7fc87766d25bb8494112be0d18fa0aeecfb2e88fa1200c8f102076fb3b35b52c96dfef8944ccc603135
ssdeep: 384:M0IRltHJLo4kPIJUaFQR9i5EHOrabDufnwWZ7JLk24jXPlH1CGa3XgQEX3Dh53p:M0IztH1GVvi5eOAcfT2XPDnjHRW
type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

Version Info:
Translation: 0x0000 0x04b0
LegalCopyright: Copyright xa9  2010
Assembly Version: 1.0.0.0
InternalName: D.exe
FileVersion: 1.0.0.0
ProductName: WindowsApplication1
ProductVersion: 1.0.0.0
FileDescription: WindowsApplication1
OriginalFilename: D.exe

Ursu.728548 also known as:

K7AntiVirus	Trojan ( 00504e2d1 )
Cynet	Malicious (score: 85)
ALYac	Gen:Variant.Ursu.728548
Cylance	Unsafe
Zillya	Trojan.Agent.Win32.778485
Sangfor	Ransom.MSIL.Tpyn.chu
Alibaba	Trojan:MSIL/Filecoder.48467ffb
K7GW	Trojan ( 00504e2d1 )
Cybereason	malicious.deba8d
ESET-NOD32	a variant of MSIL/Filecoder.Harzhuangzi.A
APEX	Malicious
Avast	Win32:Malware-gen
Kaspersky	HEUR:Trojan-Ransom.MSIL.Tpyn.chu
BitDefender	Gen:Variant.Ursu.728548
NANO-Antivirus	Trojan.Win32.FileCoder.emwdcb
MicroWorld-eScan	Gen:Variant.Ursu.728548
Tencent	Msil.Trojan.Tpyn.Hqbg
Sophos	Mal/Generic-S
Comodo	Malware@#1w5fjnrmhsh6z
BitDefenderTheta	Gen:NN.ZemsilF.34628.bq0@aKNUHkm
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	Ransom_STUPZHUANGZI.SM
Emsisoft	Gen:Variant.Ursu.728548 (B)
Webroot	W32.Ransom.Gen
Avira	TR/FileCoder.npjgw
Kingsoft	Win32.Troj.Generic_a.a.(kcloud)
Arcabit	Trojan.Ursu.DB1DE4
AegisLab	Trojan.MSIL.Tpyn.j!c
ZoneAlarm	HEUR:Trojan-Ransom.MSIL.Tpyn.chu
GData	MSIL.Trojan-Ransom.Filecoder.AU
AhnLab-V3	Trojan/Win32.FileCryptor.C1954352
McAfee	Artemis!93185DBDEBA8
MAX	malware (ai score=100)
Malwarebytes	Generic.Malware/Suspicious
Panda	Trj/GdSda.A
Rising	Ransom.FileCryptor!8.1A7 (CLOUD)
Yandex	Trojan.Filecoder!osD1wIePSQ4
eGambit	Unsafe.AI_Score_99%
Fortinet	MSIL/Filecoder.FG!tr.ransom
AVG	Win32:Malware-gen
Qihoo-360	Win32/Ransom.Filecoder.HgIASRIA

How to remove Ursu.728548?

Ursu.728548 removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X