About “Ursu.749416” infection

The Ursu.749416 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Ursu.749416 virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Dynamic (imported) function loading detected
• Reads data out of its own binary image
• A process created a hidden window
• CAPE extracted potentially suspicious content
• Authenticode signature is invalid
• Created a process from a suspicious location
• CAPE detected the HiddenVNC malware family

How to determine Ursu.749416?

File Info:
name: BB00BA9726F922E07CF2.mlw
path: /opt/CAPEv2/storage/binaries/1f03ab2c168de4e82e8fd52b974180683044fce88d1128fa5691abbe313a2593
crc32: 52E7B9BB
md5: bb00ba9726f922e07cf243d3ccfc2b6e
sha1: 30e0181a018fa7dcbd2344dc32adcf77cf840ebe
sha256: 1f03ab2c168de4e82e8fd52b974180683044fce88d1128fa5691abbe313a2593
sha512: 5a66e31992955c0c39214e16ae989948c9e5fd6e886e0ffd8ee67b324830b67f6e5317297e3ace53686a4aa20117d8be4125f3d8d73282d194a7478434405f85
ssdeep: 12288:lcNVdCNGt9AtLPAzAO62bAl31YAhKOkFncdL0IUIv:K/dCItuhPAn6a03KAuFncdL0w
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1B9B41289E3E2D8D3F9361B31493A9B58476B5C268458622F079CB43A7D33283553F29B
sha3_384: d07ec0a18ac3ad34958943823cb449c6244908bc1197994564857ce86fed092fd4c84e3fb71c02a7c216597bc86c9bae
ep_bytes: 81ec8401000053565733db6801800000
timestamp: 2018-01-30 03:57:45

Version Info:
xvsadsad: qweasdsadsad
wqeasdasd: cxvcvxvcx
FileVersion: 51.9.0.0
xcvxcsadsad: 
LegalCopyright: qvscsd axqsc cxasd qsadacaa
LegalTrademarks: 
cxzcxzcxzc: 
ProductName: 
zxcxzcxzcxzc:  
Comments: zxcssssse: hsdsds
Translation: 0x0409 0x04e4

Ursu.749416 also known as:

How to remove Ursu.749416?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.