Categories: Malware

Ursu.899194 removal

The Ursu.899194 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Ursu.899194 virus can do?

Attempts to connect to a dead IP:Port (1 unique times)
Possible date expiration check, exits too soon after checking local time
A process attempted to delay the analysis task.
Expresses interest in specific running processes
Attempts to repeatedly call a single API many times in order to delay analysis time
Checks the CPU name from registry, possibly for anti-virtualization
Attempts to create or modify system certificates
Collects information to fingerprint the system

Related domains:

robotatten.com

How to determine Ursu.899194?


File Info:
crc32: 685B2DEDmd5: 89c47e27bec5a374476ffaf92ab2b6d2name: tmpklc50eibsha1: 6486a7db83b1be2ed5ef7239262d22508d3e075asha256: 407c70f0c1a1e34503dae74dd973cf037d607e3c4deb8f063d33f2142f1baf71sha512: f0c65570b230236b2dda4e326122f54b8174fd2d17c6e5c9ddb1b0f80c9733f023ba86252400dc0bc9ee314fb4023bd1dac6fda6297e17fe18493d175f2634bcssdeep: 98304:kzHf7vmorbC/yNwFC6TJZcE94Kcj3sA/Ibt1YcyDXs:+Hzvpr6FHt4Kc+NIstype: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Version Info:
0: [No Data]

Ursu.899194 also known as:

Bkav	W32.AIDetectVM.malware2
ClamAV	Win.Malware.Emotet-7359783-0
FireEye	Generic.mg.89c47e27bec5a374
McAfee	Trojan-FSCT!89C47E27BEC5
Cylance	Unsafe
Zillya	Trojan.RanumBot.Win32.124
Sangfor	Malware
CrowdStrike	win/malicious_confidence_60% (W)
BitDefender	Gen:Variant.Ursu.899194
K7GW	Trojan ( 0053252a1 )
K7AntiVirus	Trojan ( 0053252a1 )
Arcabit	Trojan.Ursu.DDB87A
TrendMicro	TROJ_GEN.R007C0DFM20
F-Prot	W32/Glupteba.D.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/RanumBot.B
APEX	Malicious
Paloalto	generic.ml
Cynet	Malicious (score: 90)
Kaspersky	HEUR:Trojan-DDoS.Win32.Windigo.vho
Alibaba	Trojan:Win32/RanumBot.571db445
NANO-Antivirus	Trojan.Win32.Windigo.hbjazv
AegisLab	Trojan.Win32.Fsysna.tr1H
MicroWorld-eScan	Gen:Variant.Ursu.899194
Avast	Win32:Trojan-gen
Rising	Trojan.RanumBot!8.112AC (CLOUD)
Ad-Aware	Gen:Variant.Ursu.899194
Emsisoft	Gen:Variant.Ursu.899194 (B)
F-Secure	Trojan.TR/Spy.Gen8
DrWeb	Trojan.SpyBot.936
VIPRE	Trojan.Win32.Generic!BT
Fortinet	PossibleThreat.MU
Sophos	Mal/Generic-S
Ikarus	Trojan.Win32.Ranumbot
Cyren	W32/Glupteba.D.gen!Eldorado
Jiangmin	TrojanDDoS.Windigo.oa
Avira	TR/Spy.Gen8
eGambit	Unsafe.AI_Score_98%
MAX	malware (ai score=81)
Antiy-AVL	Trojan[DDoS]/Win32.Windigo
Endgame	malicious (high confidence)
Microsoft	Trojan:Win32/Skeeyah.A!rfn
ZoneAlarm	HEUR:Trojan-DDoS.Win32.Windigo.vho
AhnLab-V3	Trojan/Win32.RanumBot.R334753
ALYac	Trojan.DDoS.Windigo
VBA32	TrojanDDoS.Windigo
Malwarebytes	Trojan.Downloader
TrendMicro-HouseCall	TROJ_GEN.R007C0DFM20
Yandex	Trojan.RanumBot!
SentinelOne	DFI – Suspicious PE
MaxSecure	Trojan.Malware.74730673.susgen
GData	Gen:Variant.Ursu.899194
BitDefenderTheta	Gen:NN.ZexaF.34130.@xW@aiCmICo
AVG	Win32:Trojan-gen
Cybereason	malicious.7bec5a
Qihoo-360	Win32/Trojan.DDoS.a89