Categories: Trojan

Trojan.Urelas malicious file

The Trojan.Urelas is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.Urelas virus can do?

Attempts to connect to a dead IP:Port (4 unique times)
Possible date expiration check, exits too soon after checking local time
Reads data out of its own binary image
A process created a hidden window
Drops a binary and executes it
Unconventionial language used in binary resources: Korean
The binary likely contains encrypted or compressed data.
Uses Windows utilities for basic functionality
Deletes its original binary from disk
Creates a slightly modified copy of itself
Anomalous binary characteristics

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine Trojan.Urelas?


File Info:
crc32: 413A6275md5: d0bd53fb64129e0aaf2b53caa3b7062fname: D0BD53FB64129E0AAF2B53CAA3B7062F.mlwsha1: 50a73673bc44806e49219d0eeb88b6c4ff55fecasha256: 956dc7b9a15b6459ab0ffe0117f50d09e3ffa0c7aa10bf9e1e20821fa79a9973sha512: 8b1b2128885a45af69e4cf43f09b836bd106f7029e475c7804d587df634864f2c54e0f9aa3f98906d626eb93936ef553081e1e9d35f94210cbf9f82b3d15cc9fssdeep: 12288:m6twjLHj/8/GcHUIdPPzEmvTnabAh0ZnAr1U5:m6tQCG0UUPzEkTn4AC1+Otype: PE32 executable (GUI) Intel 80386, for MS Windows, PECompact2 compressed
Version Info:
0: [No Data]

Trojan.Urelas also known as:

Elastic	malicious (high confidence)
DrWeb	Trojan.DownLoader10.41824
MicroWorld-eScan	Gen:Heur.Mint.SP.Urelas.1
FireEye	Generic.mg.d0bd53fb64129e0a
CAT-QuickHeal	Trojan.Gupboot.G.mue
Qihoo-360	Win32/Trojan.Plite.B
McAfee	BackDoor-FBLQ!D0BD53FB6412
Cylance	Unsafe
Zillya	Backdoor.Plite.Win32.798
AegisLab	Trojan.Win32.Plite.m8Ou
Sangfor	Malware
K7AntiVirus	Backdoor ( 0053e8561 )
BitDefender	Gen:Heur.Mint.SP.Urelas.1
K7GW	Trojan ( 0048f6021 )
Cybereason	malicious.b64129
BitDefenderTheta	Gen:NN.ZexaF.34804.DmX@aiFJQWoO
Cyren	W32/Urelas.E.gen!Eldorado
Symantec	Infostealer.Gampass
APEX	Malicious
Avast	Win32:Dropper-NGS [Drp]
ClamAV	Win.Trojan.Urelas-6804556-0
Kaspersky	Backdoor.Win32.Plite.bhud
Alibaba	Malware:Win32/Dorpal.ali1000029
NANO-Antivirus	Trojan.Win32.Plite.hdyyae
Rising	Trojan.Win32.Gupboot.a (CLASSIC)
Ad-Aware	Gen:Heur.Mint.SP.Urelas.1
Sophos	ML/PE-A + Troj/Urelas-Q
Comodo	TrojWare.Win32.Urelas.ET@5ihp6w
F-Secure	Heuristic.HEUR/AGEN.1133840
Baidu	Win32.Trojan.Urelas.a
VIPRE	Trojan.Win32.Urelas.o (v)
TrendMicro	TROJ_GEN.R002C0DAP21
McAfee-GW-Edition	BackDoor-FBLQ!D0BD53FB6412
Emsisoft	Gen:Heur.Mint.SP.Urelas.1 (B)
SentinelOne	Static AI – Malicious PE – Spyware
Jiangmin	Backdoor/Plite.cd
Avira	HEUR/AGEN.1133840
MAX	malware (ai score=89)
Antiy-AVL	Trojan[Backdoor]/Win32.Plite
Microsoft	Trojan:Win32/Urelas!rfn
Arcabit	Trojan.Mint.SP.Urelas.1
SUPERAntiSpyware	Backdoor.Plite/Variant
ZoneAlarm	Backdoor.Win32.Plite.bhud
GData	Gen:Heur.Mint.SP.Urelas.1
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Urelas.R87160
Acronis	suspicious
VBA32	Backdoor.Plite
Malwarebytes	Trojan.Urelas
Panda	Trj/Genetic.gen
ESET-NOD32	a variant of Win32/Urelas.U
TrendMicro-HouseCall	TROJ_GEN.R002C0DAP21
Tencent	Malware.Win32.Gencirc.10b0c31d
Yandex	Trojan.GenAsa!PtO2O3kjWvs
Ikarus	Trojan.Win32.Urelas
eGambit	Unsafe.AI_Score_95%
Fortinet	W32/Urelas.U!tr
AVG	Win32:Dropper-NGS [Drp]
Paloalto	generic.ml
CrowdStrike	win/malicious_confidence_100% (D)
MaxSecure	Backdoor.Plite.bhud