Ursu.848177 (file analysis)

The Ursu.848177 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Ursu.848177 virus can do?

Executable code extraction
Injection (inter-process)
Injection (Process Hollowing)
Creates RWX memory
HTTP traffic contains suspicious features which may be indicative of malware related traffic
Performs some HTTP requests
The binary likely contains encrypted or compressed data.
The executable is compressed using UPX
Executed a process and injected code into it, probably while unpacking
Attempts to repeatedly call a single API many times in order to delay analysis time
Steals private information from local Internet browsers
Spoofs its process name and/or associated pathname to appear as a legitimate process
Harvests credentials from local FTP client softwares
Harvests information related to installed instant messenger clients
Harvests information related to installed mail clients
Collects information to fingerprint the system

Related domains:

z.whorecord.xyz

a.tomx.xyz

mahetechasia.com

How to determine Ursu.848177?


File Info:
crc32: 68B5A847
md5: 1857adde60c82832df14b3d796aee798
name: 1857ADDE60C82832DF14B3D796AEE798.mlw
sha1: 906b22e93b7f682a72d79348f73f879935ef6b62
sha256: 1c21c7c621b4d7f5d39f3563c5625489c186da307a60399f918c5e8558d6458a
sha512: e9dbbe8706c2014ec52d0dd882f287c0a6bec27924001b0c270ccac1fe5675ca566d49d4f7b3a5105e914a5cedf47cb91263ba78386c9b59ec047a52af6afa60
ssdeep: 12288:wM/wfkb/+oN88KT5q+EROwv6tZYE3s3a:wubb/+vrOO46i
type: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed

Version Info:
LegalCopyright: xa92okfsfrg>
InternalName: m4
FileVersion: 1.o;7
License: This progldft/jler.html. 
CompanyName: Grjg.iet>
LegalTrademarks: Guo4xae
WWW: htthpwtyoe/m4
ProductName: oM
ProductVersion: o12
FileDescription: Mo4f;or
OriginalFilename: .e2oxoe
Translation: 0x0409 0x04e4

Ursu.848177 also known as:

Bkav	W32.AIDetect.malware1
K7AntiVirus	Trojan ( 0051918e1 )
Elastic	malicious (high confidence)
DrWeb	Trojan.PWS.Stealer.21154
Cynet	Malicious (score: 99)
CAT-QuickHeal	Trojan.GenericIH.S14446467
ALYac	Gen:Variant.Ursu.848177
Cylance	Unsafe
CrowdStrike	win/malicious_confidence_80% (D)
K7GW	Trojan ( 0051918e1 )
Cybereason	malicious.e60c82
Cyren	W32/DelfInject.CI.gen!Eldorado
Symantec	Infostealer.Lokibot!43
ESET-NOD32	a variant of Win32/Injector.ELRF
APEX	Malicious
Avast	Win32:PWSX-gen [Trj]
ClamAV	Win.Dropper.LokiBot-8195153-0
Kaspersky	HEUR:Backdoor.Win32.Androm.gen
BitDefender	Gen:Variant.Ursu.848177
NANO-Antivirus	Trojan.Win32.Stealer.hjobpd
MicroWorld-eScan	Gen:Variant.Ursu.848177
Ad-Aware	Gen:Variant.Ursu.848177
Sophos	ML/PE-A + Mal/Fareit-AA
BitDefenderTheta	Gen:NN.ZelphiF.34770.zmKfa41Nnmni
McAfee-GW-Edition	Fareit-FUO!1AF44349DA80
FireEye	Generic.mg.1857adde60c82832
Emsisoft	Gen:Variant.Ursu.848177 (B)
Jiangmin	Backdoor.Androm.avya
Avira	HEUR/AGEN.1135316
eGambit	Unsafe.AI_Score_99%
Microsoft	Trojan:Win32/Wacatac.B!ml
GData	Gen:Variant.Ursu.848177
AhnLab-V3	Suspicious/Win.Delphiless.X2059
McAfee	Fareit-FUO!1AF44349DA80
MAX	malware (ai score=87)
VBA32	Backdoor.Androm
Malwarebytes	Trojan.MalPack.DLF.Generic
Ikarus	Trojan.Win32.Injector
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/Injector.ELKP!tr
AVG	Win32:PWSX-gen [Trj]
Qihoo-360	HEUR/QVM11.1.4AEF.Malware.Gen

How to remove Ursu.848177?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Ursu.848177 (file analysis)