About “Ursu.885394” infection

The Ursu.885394 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Ursu.885394 virus can do?

• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Performs HTTP requests potentially not found in PCAP.
• Unconventionial binary language: Chinese (Simplified)
• Unconventionial language used in binary resources: Chinese (Simplified)
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Attempts to modify proxy settings
• Attempts to modify browser security settings
• Harvests cookies for information gathering

How to determine Ursu.885394?

File Info:
name: 5A1E8B751904FE776EC1.mlw
path: /opt/CAPEv2/storage/binaries/0f02f480b37f498e001ce0c5f75832f1b0c0f2b6fef26b749f3b7d160d49872b
crc32: A98E35A1
md5: 5a1e8b751904fe776ec1d46d70037757
sha1: b03a69b450a86e3799e09d49bba96db943bdcfaf
sha256: 0f02f480b37f498e001ce0c5f75832f1b0c0f2b6fef26b749f3b7d160d49872b
sha512: 838424b50fd2b846ebb207cdb990b5929383eae0ba7862043d1127517f83d8fa8a7ef9152d619633f91346e1ec541d2035ef4cc197e02f4a8cfc49d6bd921f89
ssdeep: 12288:a4QCU6yWWOu8n9x/Qz4F0cOm6YY++lN46jc92zs03f7bZvTOq/8pTcKvFH:a4DU6yZOhnz64yco++v4wRP5BYbH
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1C235C0A1F2D380F2C65211304D6BA736DE39FA5A0A25CBD3A794DE7D1D33601DA2731A
sha3_384: 9cf96253fafcdbbc3dcfc32edc38c013446397e74fe35e06e915969c488cb997f0482f33fc5aba134bde1eea98f624ec
ep_bytes: e8da770000e978feffffb80ab24700a3
timestamp: 2016-08-28 01:45:12

Version Info:
FileVersion: 2.2.1.1
FileDescription:  
ProductName: 斗图大师 2.2
ProductVersion: 2.2.1.1
CompanyName:  
LegalCopyright:  
Comments: 本程序使用易语言编写(http://www.dywt.com.cn)
Translation: 0x0804 0x04b0

Ursu.885394 also known as:

How to remove Ursu.885394?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.