Categories: Malware

Troj/Urelas-AS removal guide

The Troj/Urelas-AS is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Troj/Urelas-AS virus can do?

Sample contains Overlay data
Uses Windows utilities for basic functionality
Reads data out of its own binary image
Drops a binary and executes it
Authenticode signature is invalid
Uses Windows utilities to create a scheduled task
Deletes executed files from disk
Anomalous binary characteristics

How to determine Troj/Urelas-AS?


File Info:
name: 799B2907F5AB3C99CDD1.mlwpath: /opt/CAPEv2/storage/binaries/7be33e7bb95c6d80deb46b7eaa26ee1f33e7037899020957b916e1ca3f8c2ec2crc32: 88A56492md5: 799b2907f5ab3c99cdd1a5180886af8asha1: b1fc690fe56a1d128be70d96ecf4d827674026eesha256: 7be33e7bb95c6d80deb46b7eaa26ee1f33e7037899020957b916e1ca3f8c2ec2sha512: 71ee40c722a08dd1cd8f30943f45f834f76856d1f45e96909c8dbb312b1d15bd9bae8510fc57e3c1ea9a0d0a360e958f739ada1defaab5b7e67855683032bcd5ssdeep: 1536:iADe0Wbt1931D2P7BWLQ4zR4LUKMcPHFE3HP/G8j65CGE8ppR:iADe0Wc7UJ6LZMaHkj65DEGpRtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T170D3F61176408471F3590B324916EAE14969AC3D1AE4F98FF7787E3A5E322C39A7324Fsha3_384: 336e67e3a57696f8cdb83978b5560e4b44e87587ac336e9cd27dc1e68017b352cfb01374ac8f16d7d4b48685be40e304ep_bytes: e819520000e979feffff8bff558bec8btimestamp: 2014-06-05 06:54:42
Version Info:
0: [No Data]

Troj/Urelas-AS also known as:

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Plite.4!c
MicroWorld-eScan	Gen:Heur.Mint.SP.Urelas.1
ClamAV	Win.Malware.Urelas-6717394-0
CAT-QuickHeal	Trojan.Beaugrit.14262
McAfee	PWS-FBQQ!799B2907F5AB
Cylance	unsafe
VIPRE	Gen:Heur.Mint.SP.Urelas.1
Sangfor	Worm.Win32.Save.a
K7AntiVirus	Backdoor ( 0053e8561 )
Alibaba	Backdoor:Win32/Urelas.2ee0
K7GW	Backdoor ( 0053e8561 )
Cybereason	malicious.fe56a1
Baidu	Win32.Trojan.Urelas.a
VirIT	Trojan.Win32.Generic.ECB
Cyren	W32/Urelas.DE.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/Urelas.U
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	Backdoor.Win32.Plite.bhtr
BitDefender	Gen:Heur.Mint.SP.Urelas.1
NANO-Antivirus	Trojan.Win32.Urelas.kbmpfg
Avast	Win32:BackdoorX-gen [Trj]
Tencent	Trojan.Win32.Urelas.16000161
Emsisoft	Gen:Heur.Mint.SP.Urelas.1 (B)
F-Secure	Trojan.TR/Crypt.XPACK.Gen7
DrWeb	BackDoor.Golf.196
Zillya	Trojan.Urelas.Win32.9044
McAfee-GW-Edition	BehavesLike.Win32.Dropper.cm
FireEye	Generic.mg.799b2907f5ab3c99
Sophos	Troj/Urelas-AS
SentinelOne	Static AI – Suspicious PE
GData	Win32.Trojan.PSE.111SHMK
Jiangmin	Trojan/GenericCryptor.bt
Avira	TR/Crypt.XPACK.Gen7
MAX	malware (ai score=83)
Antiy-AVL	Trojan/Win32.Urelas
Kingsoft	malware.kb.a.974
Xcitium	TrojWare.Win32.Urelas.SH@5674sp
Arcabit	Trojan.Mint.SP.Urelas.1
ZoneAlarm	Backdoor.Win32.Plite.bhtr
Microsoft	Trojan:Win32/Urelas!atmnm
Google	Detected
AhnLab-V3	Trojan/Win32.Urelas.R149212
Acronis	suspicious
BitDefenderTheta	Gen:NN.ZexaF.36738.iuX@aeMIvCmi
VBA32	SScope.Backdoor.Urelas.3114
Malwarebytes	Generic.Malware.AI.DDS
Panda	Trj/Genetic.gen
Rising	Trojan.Urelas!1.BE13 (CLASSIC)
Yandex	Trojan.Agent!raykctppMIM
Ikarus	Trojan.Win32.Beaugrit
MaxSecure	Trojan.Malware.121218.susgen
Fortinet	W32/Urelas.U!tr
AVG	Win32:BackdoorX-gen [Trj]
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_100% (D)