Should I remove “Ursu.848028”?

The Ursu.848028 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Ursu.848028 virus can do?

Network activity detected but not expressed in API logs
Anomalous binary characteristics

How to determine Ursu.848028?


File Info:
crc32: ACB0B754
md5: 5d37547c94be2f8e560a85f8309f3124
name: 5D37547C94BE2F8E560A85F8309F3124.mlw
sha1: 224057fb6f04a1e930509faae08f0bdbf25f3592
sha256: 3f8c2b74f972989f998da55f17902a5db6556d24700a600bc38117f25cc9b441
sha512: 123613908c73876fba4eb18458e005e943e307049560808489018daebc945c1aab0574bad16d596b17a073f98bd9e252b4242f3f6d50667d7a64105e5f285bd7
ssdeep: 192:h4t4exJg4tloQSMJmxN7FpTJx0Mhx0IpOJXD:h4t4eQ4tiQSMJ8Fp9x0MLSX
type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

Version Info:
Translation: 0x0000 0x04b0
LegalCopyright: Copyright xa9  2020
Assembly Version: 1.0.0.0
InternalName: Crypto-Clipboard.exe
FileVersion: 1.0.0.0
CompanyName: 
LegalTrademarks: 
Comments: 
ProductName: Crypto-Clipboard
ProductVersion: 1.0.0.0
FileDescription: Crypto-Clipboard
OriginalFilename: Crypto-Clipboard.exe

Ursu.848028 also known as:

Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Ursu.848028
ALYac	Gen:Variant.Ursu.848028
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
BitDefender	Gen:Variant.Ursu.848028
CrowdStrike	win/malicious_confidence_90% (W)
BitDefenderTheta	Gen:NN.ZemsilF.34590.am0@a4IZnuf
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Avast	Win32:Trojan-gen
Kaspersky	HEUR:Trojan-Banker.MSIL.ClipBanker.gen
Alibaba	Trojan:Win32/Starter.ali2000005
Rising	Trojan.ClipBanker!8.5FB (CLOUD)
Ad-Aware	Gen:Variant.Ursu.848028
Emsisoft	Gen:Variant.Ursu.848028 (B)
McAfee-GW-Edition	GenericRXGG-KX!5D37547C94BE
FireEye	Gen:Variant.Ursu.848028
Microsoft	Trojan:Win32/Wacatac.B!ml
Arcabit	Trojan.Ursu.DCF09C
ZoneAlarm	HEUR:Trojan-Banker.MSIL.ClipBanker.gen
GData	Gen:Variant.Ursu.848028
McAfee	GenericRXGG-KX!5D37547C94BE
MAX	malware (ai score=86)
Panda	Trj/GdSda.A
ESET-NOD32	a variant of MSIL/ClipBanker.PB
Tencent	Msil.Trojan-banker.Clipbanker.Swux
SentinelOne	Static AI – Malicious PE
AVG	Win32:Trojan-gen
Cybereason	malicious.c94be2

How to remove Ursu.848028?

Ursu.848028 removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X