Categories: Malware

About “Ursu.882252 (B)” infection

The Ursu.882252 (B) is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Ursu.882252 (B) virus can do?

Behavioural detection: Executable code extraction – unpacking
Sample contains Overlay data
Reads data out of its own binary image
Drops a binary and executes it
Unconventionial language used in binary resources: Chinese (Simplified)
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid
Deletes executed files from disk

How to determine Ursu.882252 (B)?


File Info:
name: F471877FC75D1B599CD9.mlwpath: /opt/CAPEv2/storage/binaries/580b8c2f556209dd5aab190f84d235292a50c7aa1e5c86dfec339316fc35c7ffcrc32: E43FC7A2md5: f471877fc75d1b599cd90ef6d8ec7fecsha1: 6ba14527c09e79356d22e7c8edda7654fc674a41sha256: 580b8c2f556209dd5aab190f84d235292a50c7aa1e5c86dfec339316fc35c7ffsha512: 5bf544ee7d59e93d0bd933946db381d35e2b0a2f1c66d7a935c613b843de2a712f40561c9541324a42c9bc3bcefce8167e439026b9706aba9e0f692e068c21e1ssdeep: 6144:MrojxC5Sjo6KCD4SLNdcrvUL11Nup7RGv7qwoSavQ9G/JRt7g0g:vjxC5O5KC1Qcc7G2ZtiGxYtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1D8641202DAD584B2E170CEB04E29A0049A377E673C74612D36DC6DCD8F376E19A6B793sha3_384: d32b0bbf70055dacba734049470a6ee4bf6f640dc6558e5a4746e304ed7a26b2e295e2a631a87ff6b129b5d18418f94aep_bytes: 558bec83c4c453565733c08945f08945timestamp: 1992-06-19 22:22:17
Version Info:
Comments: This installation was built with Inno Setup.CompanyName: EasyLook                                                    FileDescription: EasyLook Setup                                              FileVersion:                     LegalCopyright:                                                                                                     ProductName: EasyLook                                                    ProductVersion: 1.0.0.3             Translation: 0x0000 0x04b0

Ursu.882252 (B) also known as:

Lionic	Trojan.Win32.Agent.a!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Ursu.882252
FireEye	Gen:Variant.Ursu.882252
ALYac	Gen:Variant.Ursu.882252
Cylance	unsafe
VIPRE	Gen:Variant.Ursu.882252
Sangfor	Trojan.Win32.Agent.8
CrowdStrike	win/malicious_confidence_100% (W)
Alibaba	TrojanDownloader:Win32/Generic.d9128e04
K7GW	Trojan ( 00534de11 )
K7AntiVirus	Trojan ( 00534de11 )
Cyren	W32/Delf.IB.gen!Eldorado
Symantec	Trojan.Gen.MBT
ESET-NOD32	a variant of Win32/TrojanDownloader.Agent.DZZ
APEX	Malicious
Paloalto	generic.ml
ClamAV	Win.Malware.Cerbu-9963893-0
Kaspersky	Trojan-Downloader.Win32.Agent.xxybos
BitDefender	Gen:Variant.Ursu.882252
NANO-Antivirus	Trojan.Win32.Dwn.fdsxpe
Avast	Win32:Malware-gen
Tencent	Win32.Trojan-Downloader.Agent.Ywhl
Emsisoft	Gen:Variant.Ursu.882252 (B)
F-Secure	Heuristic.HEUR/AGEN.1333112
DrWeb	Trojan.DownLoader26.47970
Zillya	Downloader.Agent.Win32.352667
McAfee-GW-Edition	Downloader-FBSI!F471877FC75D
Trapmine	suspicious.low.ml.score
Sophos	Mal/Generic-S
Ikarus	Trojan.Downloader.Inno.Agent
Avira	HEUR/AGEN.1333112
Microsoft	Trojan:Win32/Skeeyah.A!rfn
Xcitium	Malware@#3hiavx9038o3c
Arcabit	Trojan.Ursu.DD764C
ZoneAlarm	Trojan-Downloader.Win32.Agent.xxybos
GData	Gen:Variant.Ursu.882252
Cynet	Malicious (score: 99)
AhnLab-V3	Malware/Gen.Generic.C2543952
Acronis	suspicious
McAfee	Downloader-FBSI!F471877FC75D
MAX	malware (ai score=94)
Malwarebytes	Generic.Trojan.Downloader.DDS
MaxSecure	Trojan.Malware.73446926.susgen
Fortinet	W32/Agent.EBX!tr.dldr
AVG	Win32:Malware-gen
Cybereason	malicious.fc75d1
DeepInstinct	MALICIOUS