Ursu.793273 (file analysis)

The Ursu.793273 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Ursu.793273 virus can do?

Executable code extraction
Presents an Authenticode digital signature
Creates RWX memory
Reads data out of its own binary image
Drops a binary and executes it
Performs some HTTP requests
Network activity detected but not expressed in API logs

Related domains:

z.whorecord.xyz

a.tomx.xyz

hahala.xyz

rp.grabbytetown.com

How to determine Ursu.793273?


File Info:
crc32: F3D129AF
md5: f8987808c6e0914e7e1566facd462672
name: F8987808C6E0914E7E1566FACD462672.mlw
sha1: bbc5934777abd2a732802b582df2e1e369b75da0
sha256: 7c146b7fbfa9b75225b3d1b7ace1e2ce3a03ad23d7673b870f5f4d847df9a66d
sha512: a84348021c0a6fee9e36b1fbe57a30a9022a3b7228751b78324384bea32470eaacf96334dff5edd998b961ba860826c5e38e466f32d6463328670ea64311ad31
ssdeep: 49152:Qp4UO73l/jcDkXjUzBJwtBmKNGr6KXF7BztuxxvlqnLSKhj0/:44fB/oDyjUzBJIZNm6k7oxvlqLxjw
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright:                                                                                                     
FileVersion:                     
CompanyName:                                                             
Comments: This installation was built with Inno Setup.
ProductName: ADownloader                                                 
ProductVersion: 80                                                
FileDescription: ADownloader Setup                                           
Translation: 0x0000 0x04b0

Ursu.793273 also known as:

Lionic	Trojan.Win32.Malicious.4!c
Elastic	malicious (high confidence)
DrWeb	Adware.Downware.19519
ALYac	Gen:Variant.Ursu.793273
Cylance	Unsafe
Sangfor	Trojan.Win32.Ursu.793273
CrowdStrike	win/malicious_confidence_90% (D)
K7GW	Trojan ( 005850dc1 )
K7AntiVirus	Trojan ( 0056344b1 )
Symantec	Trojan.Gen.MBT
ESET-NOD32	multiple detections
APEX	Malicious
Avast	Win32:Adware-gen [Adw]
Cynet	Malicious (score: 100)
BitDefender	Gen:Variant.Ursu.793273
NANO-Antivirus	Riskware.Win32.YoutubeDownloaderGuru.hibbrw
ViRobot	Adware.Youtubedownloadergur.2553832
MicroWorld-eScan	Gen:Variant.Ursu.793273
Ad-Aware	Gen:Variant.Ursu.793273
Sophos	YoutubeDownloaderGuru (PUA)
VIPRE	Trojan.Win32.Generic!BT
McAfee-GW-Edition	Artemis!Trojan
FireEye	Gen:Variant.Ursu.793273
Emsisoft	Gen:Variant.Ursu.793273 (B)
SentinelOne	Static AI – Malicious PE
Avira	HEUR/AGEN.1109573
Microsoft	Trojan:Win32/Tnega!ml
GData	Win32.Application.Bundler.E
AhnLab-V3	PUP/Win32.Downloader.R329844
McAfee	Artemis!F8987808C6E0
MAX	malware (ai score=84)
VBA32	Adware.Downware
TrendMicro-HouseCall	TROJ_GEN.R002H0CKF21
Rising	Trojan.Generic@ML.100 (RDML:Ju1pqUPUBun4aK8Ka3lppg)
Fortinet	Riskware/YoutubeDownloaderGuru
AVG	Win32:Adware-gen [Adw]
Paloalto	generic.ml

How to remove Ursu.793273?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Ursu.793273 (file analysis)