Malware

Ursu.857485 removal instruction

Malware Removal

The Ursu.857485 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Ursu.857485 virus can do?

  • Dynamic (imported) function loading detected
  • CAPE extracted potentially suspicious content
  • Authenticode signature is invalid
  • Binary compilation timestomping detected

How to determine Ursu.857485?



File Info:

name: D4F8D896AF29D247867B.mlw
path: /opt/CAPEv2/storage/binaries/65dc45468268ee84d28ae533ef2f2bce45d931aaa9a4443274e3fc82a890afbc
crc32: B27DCC4F
md5: d4f8d896af29d247867b8fd1bf0163d5
sha1: 8f8a5ed278494d78b60c2684255862f13671d90d
sha256: 65dc45468268ee84d28ae533ef2f2bce45d931aaa9a4443274e3fc82a890afbc
sha512: 1e4ba6f18829c4d62230a4d82bb7d69fd30d6f77801957c5cb62164e5c3fff6cebdddb1ad7b7789303a6529607b75938b730bd687ddb90016f45bf983eb721a8
ssdeep: 768:STObw/i4Ncgyk+11MtcF0ZFOlDy/Iuic+Fca4lKcTacjc3cOc5cNJcwXwoVecjce:SKbFtD9X6qBdR
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T141538E107DD210EEF37747B127DDBDFF09A6F1B92A1E62B83012A6844B71A95C852B34
sha3_384: 715b0d4952f2e21c8736c9121643c08e0fa7de144ccd074c1a04098e41effb1b3f44d543123517d5c57d1ee7ed184527
ep_bytes: ff250020400000000000000000000000
timestamp: 2089-05-14 04:20:04


Version Info:

Translation: 0x0000 0x04b0
Comments: Host Process for Windows Services
CompanyName: 
FileDescription: 
FileVersion: 6.6.6.0
InternalName: Payload.exe
LegalCopyright: Copyright ©  2022
LegalTrademarks: 
OriginalFilename: Payload.exe
ProductName: 
ProductVersion: 6.6.6.0
Assembly Version: 6.6.6.0

Ursu.857485 also known as:

LionicTrojan.Win32.Ursu.4!c
Elasticmalicious (high confidence)
MicroWorld-eScanGen:Variant.Ursu.857485
FireEyeGeneric.mg.d4f8d896af29d247
McAfeeArtemis!D4F8D896AF29
SangforExploit.MSIL.ShellCode.gen
CrowdStrikewin/malicious_confidence_90% (W)
K7GWTrojan ( 0058de671 )
K7AntiVirusTrojan ( 0058de671 )
BitDefenderThetaGen:NN.ZemsilF.34182.dm0@a8CLjch
SymantecML.Attribute.HighConfidence
ESET-NOD32a variant of MSIL/Agent.DSX
TrendMicro-HouseCallTROJ_GEN.R002H07B122
Paloaltogeneric.ml
KasperskyHEUR:Exploit.MSIL.ShellCode.gen
BitDefenderGen:Variant.Ursu.857485
APEXMalicious
TencentMsil.Exploit.Shellcode.Wtnk
EmsisoftGen:Variant.Ursu.857485 (B)
McAfee-GW-EditionArtemis!Trojan
SophosMal/Generic-S
IkarusTrojan.MSIL.Agent
AviraHEUR/AGEN.1241417
MAXmalware (ai score=84)
Antiy-AVLTrojan/Generic.ASMalwS.351F806
GridinsoftRansom.Win32.Sabsik.sa
MicrosoftTrojan:Win32/Sabsik.TE.B!ml
GDataGen:Variant.Ursu.857485
CynetMalicious (score: 100)
VBA32TScope.Trojan.MSIL
ALYacGen:Variant.Ursu.857485
MalwarebytesTrojan.PowerShell
AvastWin32:Trojan-gen
RisingTrojan.Generic/MSIL@AI.100 (RDM.MSIL:gd/VsL8ohFsyDRCxu2szUg)
SentinelOneStatic AI – Suspicious PE
MaxSecureTrojan.Malware.300983.susgen
FortinetPossibleThreat
AVGWin32:Trojan-gen
Cybereasonmalicious.6af29d
PandaTrj/GdSda.A

How to remove Ursu.857485?

Ursu.857485 removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment