Categories: Malware

How to remove “Ursu.951206”?

The Ursu.951206 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Ursu.951206 virus can do?

SetUnhandledExceptionFilter detected (possible anti-debug)
Yara rule detections observed from a process memory dump/dropped files/CAPE
Dynamic (imported) function loading detected
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid
CAPE detected the RanumBot malware family

How to determine Ursu.951206?


File Info:
name: E71932CD7284DEE64C1B.mlwpath: /opt/CAPEv2/storage/binaries/18586898654b7c82a4854b75fef7c9e7c5386661bf0c88d415a0323de6014e47crc32: C820C625md5: e71932cd7284dee64c1be8bcb2466c11sha1: 44c0494c5515a362efcabd5c4801ac1cd67214b5sha256: 18586898654b7c82a4854b75fef7c9e7c5386661bf0c88d415a0323de6014e47sha512: a9c5f54a9348008e4d278d11d1cadd7aa59891f7d59f589df5b3b59ae009d38e61cf99c3041a599f345adfba9a87a519c227b47b8387a74adc8427564a83ffc1ssdeep: 24576:OJPQa+68Iag4k85227flASlMtwoi3QEApfmvJ1r2oIVzl+gh8SL4PQlxy4TgZe7D:OlQ2S027f1toiafL8Zr+Cvqe6Y7Itype: PE32 executable (console) Intel 80386, for MS Windowstlsh: T1DB855D90F8DB10F5E90B553148B7A2AF2331620D4737DED7CA402EAAFC57AE11A37265sha3_384: d5e8da3a7363fb5ebf8e2208b95522755ea13d1e941551532814b5f29e03e2429dbc936041b025212ae4b4ca6a4ddef2ep_bytes: e97bd9ffffcccccccccccccccccccccctimestamp: 1970-01-01 00:00:00
Version Info:
0: [No Data]

Ursu.951206 also known as:

Bkav	W32.AIDetect.malware2
Lionic	Trojan.Win32.Convagent.4!c
MicroWorld-eScan	Gen:Variant.Ursu.951206
FireEye	Gen:Variant.Ursu.951206
McAfee	Artemis!E71932CD7284
Cylance	Unsafe
K7AntiVirus	Trojan ( 005772141 )
Alibaba	Trojan:Win32/RanumBot.2979550d
K7GW	Trojan ( 005772141 )
Cybereason	malicious.d7284d
Cyren	W32/Ranumbot.R.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of WinGo/RanumBot.X
APEX	Malicious
Kaspersky	VHO:Trojan.Win32.Convagent.gen
BitDefender	Gen:Variant.Ursu.951206
NANO-Antivirus	Trojan.Win32.SpyBot.imajnj
Avast	Win32:Trojan-gen
Tencent	Win32.Trojan.Ursu.Aiht
Ad-Aware	Gen:Variant.Ursu.951206
DrWeb	Trojan.SpyBot.981
Zillya	Trojan.Convagent.Win32.2636
TrendMicro	TROJ_GEN.R002C0WKO21
McAfee-GW-Edition	BehavesLike.Win32.CoinMiner.th
Emsisoft	Gen:Variant.Ursu.951206 (B)
SentinelOne	Static AI – Suspicious PE
GData	Gen:Variant.Ursu.951206
Jiangmin	Trojan.Agent.dfzw
Avira	TR/SpyBot.hanud
ViRobot	Trojan.Win32.Z.Ursu.1870848
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
Cynet	Malicious (score: 100)
AhnLab-V3	Malware/Win32.Generic.C3155694
ALYac	Gen:Variant.Ursu.951206
MAX	malware (ai score=82)
VBA32	Trojan.Convagent
Malwarebytes	Malware.AI.4125225254
TrendMicro-HouseCall	TROJ_GEN.R002C0WKO21
Rising	Trojan.Generic@ML.96 (RDML:QPHhAGvpWFPQmjGR5l8C/Q)
Yandex	Trojan.SpyBot!cWZ6NT7a/44
Ikarus	Trojan.WinGo.Ranumbot
MaxSecure	Trojan.Malware.103992196.susgen
Fortinet	W32/RanumBot.X!tr
AVG	Win32:Trojan-gen