乌尔苏木马
威胁评分卡
EnigmaSoft 威胁记分卡
EnigmaSoft 威胁记分卡是针对不同恶意软件威胁的评估报告，由我们的研究团队收集和分析。 EnigmaSoft 威胁记分卡使用多个指标对威胁进行评估和排名，包括现实世界和潜在风险因素、趋势、频率、普遍性和持续性。 EnigmaSoft 威胁记分卡会根据我们的研究数据和指标定期更新，对广泛的计算机用户有用，从寻求解决方案以从系统中删除恶意软件的最终用户到分析威胁的安全专家。
EnigmaSoft 威胁记分卡显示各种有用的信息，包括：
Popularity Rank: The ranking of a particular threat in EnigmaSoft’s Threat Database.
严重性级别：根据我们的风险建模过程和研究，确定的对象的严重性级别，以数字形式表示，如我们的威胁评估标准中所述。
受感染计算机： SpyHunter 报告的在受感染计算机上检测到的特定威胁的确认和疑似案例数量。
另请参阅威胁评估标准。
| Popularity Rank: | 14,588 |
| 威胁级别： | 90 % (高的) |
| 受感染的计算机： | 105,065 |
| 初见： | September 15, 2015 |
| 最后一次露面： | November 8, 2025 |
| 受影响的操作系统： | Windows |
Ursu 是一种具有威胁性的特洛伊木马程序，它会在您不知情或未同意的情况下侵入您的计算机，通常是利用系统漏洞和安全漏洞。它可以从损坏的网站或来自不受信任来源的电子邮件附件下载。武器化文件可以来自各种不同的类型，例如 .exe、.pif、.avi 甚至 .jpg 文件。
安装后，Ursu 会隐藏在后台，并可能执行各种有害功能，使威胁行为者能够完全控制受害者的系统。 Ursu 特洛伊木马的威胁功能可能包括删除文件、安装其他恶意软件、收集密码、更改系统设置和监控计算机活动。由于 Ursu 没有自我复制的能力，计算机用户需要采取措施保护他们的机器免受它的侵害，以防止它在他们的计算机上安装。
目录
Ursu 特洛伊木马之类的威胁有多有害
特洛伊木马威胁是可以注入或伪装成合法软件或文件的恶意软件，通常通过文件共享、下载或电子邮件传播。一旦进入您的计算机，它可能会通过禁用系统功能、劫持个人信息、访问连接到网络的其他设备或为其操作员提供对被破坏设备的远程访问来造成损害。
通常，特洛伊木马用于让黑客访问用户的设备，控制其资源并为进一步攻击（例如勒索软件和数据盗窃）创造机会。在某些情况下，它们被黑客部署以对网络和网站发起分布式拒绝服务 (DDoS) 攻击。或者，它们可用于在 PC 上安装其他威胁软件，例如键盘记录器、加密矿工等。
如何避免Ursu木马攻击？
使所有已安装的程序保持最新有助于防止攻击者瞄准安全漏洞。这不仅适用于您的操作系统，也适用于您可能拥有的任何应用程序，例如浏览器或电子邮件客户端。定期备份基本数据可以提供一种简单的方法来恢复丢失的数据，以防由于有害工具渗入您的机器的影响而发生某些事情。
在点击通过未经请求的电子邮件发送的链接时始终要小心，这一点也很重要——这种策略经常被攻击者用来试图诱骗用户下载损坏的文件。如果您收到来自未知发件人的包含附件的可疑电子邮件，请在设法验证其发件人的合法性之前尽量不要与他们互动。
注册表详情
乌尔苏木马 可能会创建以下注册表项或注册表项：
Regexp file mask
%LOCALAPPDATA%\petgame.exe
%UserProfile%\Local Settings\Application Data\petgame.exe
%windir%\branding\[RANDOM CHARACTERS].png
分析报告
一般信息
| Family Name: | Trojan.Ursu.A |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
05028cb6c42afa3c0f88162fa4ed96cd
SHA1:
f89be7fece20f436fd5552e904f971b0bcde99e3
SHA256:
4505DFE008D464402C753E1C1FCF1E4EB5D1B486E52BF67FFBE525148383E6E2
文件大小:
740.86 KB, 740864 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have exports table
- File doesn't have security information
- File is 32-bit executable
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
- File is Native application (NOT .NET application)
- File is not packed
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Icons
File Icons
This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.
Windows PE Version Information
Windows PE Version Information
This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.| 姓名 | 价值 |
|---|---|
| Company Name |
|
| File Description |
|
| File Version |
|
| Internal Name |
|
| Legal Copyright |
|
| Original Filename |
|
| Product Name |
|
| Product Version |
|
File Traits
- .NET
- x86
Files Modified
Files Modified
This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.| File | Attributes |
|---|---|
| c:\users\user\appdata\local\temp\ixp000.tmp\rmm41wz.exe | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\ixp000.tmp\rmm41wz.exe | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\ixp000.tmp\sgt41kb.exe | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\ixp000.tmp\sgt41kb.exe | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\ixp000.tmp\tmp4351$.tmp | Generic Write,Read Attributes,Delete |
| c:\users\user\appdata\local\temp\ixp001.tmp\noi55bm.exe | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\ixp001.tmp\noi55bm.exe | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\ixp001.tmp\seb00mz.exe | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\ixp001.tmp\seb00mz.exe | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\ixp001.tmp\tmp4351$.tmp | Generic Write,Read Attributes,Delete |
Show More
| c:\users\user\appdata\local\temp\ixp002.tmp\kyo67cp.exe | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\ixp002.tmp\kyo67cp.exe | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\ixp002.tmp\mti66.exe | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\ixp002.tmp\mti66.exe | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\ixp002.tmp\tmp4351$.tmp | Generic Write,Read Attributes,Delete |
Registry Modifications
Registry Modifications
This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.| Key::Value | 数据 | API Name |
|---|---|---|
| HKLM\software\wow6432node\microsoft\windows\currentversion\runonce::wextract_cleanup0 | rundll32.exe C:\WINDOWS\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\Ygrbwppu\AppData\Local\Temp\IXP000.TMP\" | RegNtPreCreateKey |
| HKLM\software\wow6432node\microsoft\windows\currentversion\runonce::wextract_cleanup1 | rundll32.exe C:\WINDOWS\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\Ygrbwppu\AppData\Local\Temp\IXP001.TMP\" | RegNtPreCreateKey |
| HKLM\software\wow6432node\microsoft\windows\currentversion\runonce::wextract_cleanup2 | rundll32.exe C:\WINDOWS\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\Ygrbwppu\AppData\Local\Temp\IXP002.TMP\" | RegNtPreCreateKey |
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Process Manipulation Evasion |
|
| Process Shell Execute |
|
| User Data Access |
|
| Encryption Used |
|
| Anti Debug |
|
Shell Command Execution
Shell Command Execution
This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.
C:\Users\Ygrbwppu\AppData\Local\Temp\IXP000.TMP\sgt41Kb.exe
|
C:\Users\Ygrbwppu\AppData\Local\Temp\IXP001.TMP\sEB00mZ.exe
|
C:\Users\Ygrbwppu\AppData\Local\Temp\IXP002.TMP\kYo67Cp.exe
|
