Ursu.766965 (file analysis)

The Ursu.766965 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Ursu.766965 virus can do?

CAPE extracted potentially suspicious content
Authenticode signature is invalid

How to determine Ursu.766965?


File Info:
name: 1874F0D71D50C06D2613.mlw
path: /opt/CAPEv2/storage/binaries/943332563044cc4bae5d8663304b2a3c852c74031fb4691b54a91e0f8f5fa43c
crc32: 6CF09AE9
md5: 1874f0d71d50c06d26134c1c6c5f3797
sha1: eee5ba4ba81a883a6527da9fd8911ed8f37c7486
sha256: 943332563044cc4bae5d8663304b2a3c852c74031fb4691b54a91e0f8f5fa43c
sha512: 377e4d106c4a238835b339a27c61f0b39d634ba6e2519b1dc0c0373fe00a47dc926d42ce4ea5c85849bb7bdaebd5f18e88db1960df3ebf56c61ca8ddf57ffd19
ssdeep: 96:bBQRXCMyyz7rR2xb47dmz/wkuw/uT+ouxm30hJl2M3YXkbXfWF2KMTiDlvpbOzNt:VQrki89ET+ouxm138fdixpbI
type: PE32 executable (console) Intel 80386, for MS Windows
tlsh: T17412B810F3E90F35E97E47780AA273515BF977334427DB4E08921AEB8D053E58622B76
sha3_384: 4c55e67257fc7f416af0fe15342762271814af227a8de88b8d25c2f1fd6f327fa106caea0ea8ca3bb20f415bb8a2838f
ep_bytes: ff250020400000000000000000000000
timestamp: 2010-02-14 13:50:06

Version Info:
CompanyName: GenoXyde-Security
Translation: 0x0000 0x04b0

Ursu.766965 also known as:

Lionic	Trojan.Win32.Ircbot.4!c
MicroWorld-eScan	Gen:Variant.Ursu.766965
Skyhigh	Artemis!Virus
McAfee	Artemis!1874F0D71D50
Cylance	unsafe
VIPRE	Gen:Variant.Ursu.766965
K7AntiVirus	Backdoor ( 00484a1e1 )
Alibaba	Trojan:MSIL/IRCBot.b1b67231
K7GW	Backdoor ( 00484a1e1 )
Arcabit	Trojan.Ursu.DBB3F5
ESET-NOD32	a variant of MSIL/IRCBot.Q
BitDefender	Gen:Variant.Ursu.766965
Avast	Win32:Trojan-gen
Emsisoft	Gen:Variant.Ursu.766965 (B)
Zillya	Trojan.IRCBot.Win32.14000
Sophos	Mal/Generic-S
Ikarus	Trojan.MSIL.IRCBot
Antiy-AVL	Trojan/MSIL.IRCBot
Kingsoft	malware.kb.c.983
Microsoft	Trojan:Win32/Wacatac.B!ml
GData	Gen:Variant.Ursu.766965
Google	Detected
AhnLab-V3	Trojan/Win.Generic.C5452131
MAX	malware (ai score=99)
Malwarebytes	Generic.Malware/Suspicious
Rising	Trojan.IRCBot!8.588 (CLOUD)
Yandex	Trojan.IRCBot!RVmGX2GE3wI
MaxSecure	Trojan.Malware.75382763.susgen
AVG	Win32:Trojan-gen
DeepInstinct	MALICIOUS

How to remove Ursu.766965?

Ursu.766965 removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X