What is “Ursu.827339”?

The Ursu.827339 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Ursu.827339 virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Attempts to connect to a dead IP:Port (1 unique times)
• Sample contains Overlay data
• Creates RWX memory
• Possible date expiration check, exits too soon after checking local time
• Checks adapter addresses which can be used to detect virtual network interfaces
• Guard pages use detected – possible anti-debugging.
• Dynamic (imported) function loading detected
• A process created a hidden window
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• Authenticode signature is invalid
• Created a process from a suspicious location
• Collects and encrypts information about the computer likely to send to C2 server
• Installs itself for autorun at Windows startup
• Likely virus infection of existing system binary
• Creates a copy of itself
• Harvests credentials from local FTP client softwares
• Unusual version info supplied for binary
• Attempts to modify Explorer settings to prevent hidden files from being displayed

How to determine Ursu.827339?

File Info:
name: EDA01E7AAC9356F590B4.mlw
path: /opt/CAPEv2/storage/binaries/39d645aed1581d8b428ddbfc5a72dea726236e970e345a0c08e6bc95cca01046
crc32: 3B8B3866
md5: eda01e7aac9356f590b4acc67a3c8a25
sha1: 7b30921e660e86ad880c1cbf4b7b00ba9d516480
sha256: 39d645aed1581d8b428ddbfc5a72dea726236e970e345a0c08e6bc95cca01046
sha512: fe706cd0c298c0c20647746e6ad1c1fa7158811672c27c1a3d13c686f3cfde7e29a53345013963b34d0fefc3a6745a2f37451bba8be4e2a2342d541df99e0825
ssdeep: 768:46lJ40YEiiCGMGHG7e01yzx611pvy9BtNQJt/2e4fYsPI:Pk0Yhyr93NQJtZ36I
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1639409082B8FA7EBEBBD1AB802A6E24507F5C1531112FB0A7DCE75E517D27D40B052E6
sha3_384: 948ef9ce00ecc54623a441f88fdc554e3852cb17f1249ce46e8557c9c53f73bc02425ee0376aac47fd8deb2ed0b8be40
ep_bytes: ff250020400000000000000000000000
timestamp: 2011-04-28 12:13:28

Version Info:
Comments: Windows Graphisolierung für Audiohdgeräte
CompanyName: Windows Graphisolierung für Audiohdgeräte
FileDescription: audiohd.exe
FileVersion: 8.3.6.1
InternalName: audio.exe
LegalCopyright: Copyright © Microsoft
OriginalFilename: audio.exe
ProductName: Windows Graphisolierung für Audiohdgeräte
ProductVersion: 8.3.6.1
Assembly Version: 4.1.3.6
Translation: 0x0000 0x04b0

Ursu.827339 also known as:

How to remove Ursu.827339?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.