Categories: Malware

What is “Troj/Urelas-AQ”?

The Troj/Urelas-AQ is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Troj/Urelas-AQ virus can do?

Sample contains Overlay data
Reads data out of its own binary image
Drops a binary and executes it
Authenticode signature is invalid
Uses Windows utilities for basic functionality
Uses Windows utilities to create a scheduled task
Deletes executed files from disk

How to determine Troj/Urelas-AQ?


File Info:
name: C0C48361CC53181FB86E.mlwpath: /opt/CAPEv2/storage/binaries/a5057b76634fd6ae281387134954b5143d48025afbf677eac8ec478c936671c3crc32: 17062564md5: c0c48361cc53181fb86ef9e2a8982449sha1: fe4e948c51eae1cdbb900b4c55bf336120a44cd2sha256: a5057b76634fd6ae281387134954b5143d48025afbf677eac8ec478c936671c3sha512: d510e3a3e47c419ebf73ebfa45ccc6b48c9e2dba990b22c3714a44e8e7396fe6961e14692dd478b09a1887837c606e31e0fe2916804b7c2bba503e4ba86d8664ssdeep: 1536:u7IzJdvRNtIBc6oSCv1WMW/3Gk5cTersWjcdK6U0Pf3etX:u6HC9C9WZvnqeUK6U0Pf3etXtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T17BE35B00B7D1C076E0B90A3048A89B314A3EFD325B75899BB7D4924ECD346D0BE36B76sha3_384: 5a13b0d178b884095da33f096615aebee1d304df087d94108831a25a45205ba56c494851a843166392d5a4f22ee53b39ep_bytes: e8df5c0000e97ffeffff558bec5633f6timestamp: 2014-10-24 06:42:19
Version Info:
CompanyName: GodufnbPoldjhfeFileDescription: WinndfePokdhfrFileVersion: 1.0.0.1InternalName: DiohsgYusgfeLegalCopyright: Copyright 2014 AiosfdHuisfeOriginalFilename: SiodhPSksfProductName: LokdhhdfProductVersion: 1.0.0.1Translation: 0x0409 0x04b0

Troj/Urelas-AQ also known as:

Bkav	W32.AIDetectMalware
Elastic	malicious (high confidence)
DrWeb	Trojan.DownLoader11.30531
MicroWorld-eScan	Trojan.GenericKDZ.95633
ClamAV	Win.Malware.Urelas-6717394-0
FireEye	Generic.mg.c0c48361cc53181f
CAT-QuickHeal	Trojan.Mauvaise.SL1
McAfee	PWS-FDJS!C0C48361CC53
Cylance	unsafe
Zillya	Backdoor.Plite.Win32.952
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (D)
K7GW	Riskware ( 0040eff71 )
K7AntiVirus	Riskware ( 0040eff71 )
Arcabit	Trojan.Generic.D17591
BitDefenderTheta	Gen:NN.ZexaF.36196.ju2@aqyopIgi
Cyren	W32/Urelas.AK.gen!Eldorado
Symantec	Downloader
ESET-NOD32	a variant of Win32/Urelas.AE
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	Backdoor.Win32.Plite.bhsv
BitDefender	Trojan.GenericKDZ.95633
NANO-Antivirus	Trojan.Win32.Dwn.dgxfhb
Avast	Win32:BackdoorX-gen [Trj]
Tencent	Trojan.Win32.Urelas.16000161
Emsisoft	Trojan.GenericKDZ.95633 (B)
F-Secure	Backdoor.BDS/Backdoor.Gen7
Baidu	Win32.Trojan.Urelas.b
VIPRE	Trojan.GenericKDZ.95633
McAfee-GW-Edition	BehavesLike.Win32.NetLoader.ct
Trapmine	suspicious.low.ml.score
Sophos	Troj/Urelas-AQ
Jiangmin	Backdoor.Generic.afyw
Avira	BDS/Backdoor.Gen7
Antiy-AVL	GrayWare/Win32.Generic
Xcitium	TrojWare.Win32.Urelas.SEE@5443e3
Microsoft	Trojan:Win32/Urelas!atmnm
ViRobot	Trojan.Win32.LockBit.127853
ZoneAlarm	Backdoor.Win32.Plite.bhsv
GData	Win32.Trojan.PSE.10SLHJT
Google	Detected
AhnLab-V3	Backdoor/Win32.Plite.R236153
VBA32	SScope.Backdoor.Urelas.3114
ALYac	Trojan.GenericKDZ.95633
MAX	malware (ai score=88)
Malwarebytes	Urelas.Trojan.Downloader.DDS
Panda	Trj/Genetic.gen
Rising	Trojan.Urelas!1.BE13 (CLASSIC)
Yandex	Backdoor.Plite!M7Yv8D1zpJ4
Ikarus	Gen.Conjar
MaxSecure	Trojan.Malware.121218.susgen
Fortinet	W32/Urelas.U!tr
AVG	Win32:BackdoorX-gen [Trj]
Cybereason	malicious.1cc531
DeepInstinct	MALICIOUS