TrojanDownloader:Win32/Unruy!pz malicious file

The TrojanDownloader:Win32/Unruy!pz is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What TrojanDownloader:Win32/Unruy!pz virus can do?

Reads data out of its own binary image
Unconventionial language used in binary resources: Chinese (Simplified)
Authenticode signature is invalid

How to determine TrojanDownloader:Win32/Unruy!pz?


File Info:
name: DC4541818C1A31349592.mlw
path: /opt/CAPEv2/storage/binaries/bb27156f48518d8294138224075eb052793558699a45f76ff159438a3b47c2fd
crc32: 570C64F9
md5: dc4541818c1a313495923b297674c0dc
sha1: 5489b848d7e3e73f80d99b8c52e8bf168765a8c4
sha256: bb27156f48518d8294138224075eb052793558699a45f76ff159438a3b47c2fd
sha512: 3bfa02e2037c7327e1bdee1c1254c901330ad3e0752f568a587415d5a72fab24877ed99390170ab2c7248bd9ae1be6d6f0f34537c89d50d13c6806eb09ed4f18
ssdeep: 98304:nGycOCGycO6GycOFGycOXGycOaGycOlGycOXGycO6GycOFGycOKGyaOaGyaOIGyG:GEcHl8nFcHkWMh
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T11426AE35403D1C63C3B9BC3CF245D4E151A102EA5AA71DCAEE59883A69F1D9C9B1E3CB
sha3_384: fb4ae534b5533918fd6613046d9eca68f68c3c83d62b776facdabfa244b5b44e1c430333d1f5fb1494c52dac48b064f2
ep_bytes: 558bec6aff6898dc4400688685440064
timestamp: 2010-06-09 10:32:16

Version Info:
0: [No Data]

TrojanDownloader:Win32/Unruy!pz also known as:

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Generic.ljdO
MicroWorld-eScan	Gen:Variant.Graftor.1398
FireEye	Generic.mg.dc4541818c1a3134
CAT-QuickHeal	Trojan.Mauvaise.SL1
Skyhigh	Downloader-BZH.gen.a
ALYac	Gen:Variant.Graftor.1398
Cylance	unsafe
VIPRE	Gen:Variant.Graftor.1398
Sangfor	Suspicious.Win32.Save.ins
CrowdStrike	win/malicious_confidence_100% (W)
BitDefender	Gen:Variant.Graftor.1398
BitDefenderTheta	Gen:NN.ZexaF.36792.@tW@ayniCubb
VirIT	Trojan.Win32.Agent.FQQ
Symantec	W32.Unruy.A
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
APEX	Malicious
ClamAV	Win.Trojan.Unruy-5828
Kaspersky	HEUR:Trojan.Win32.Generic
Alibaba	TrojanDownloader:Win32/Unruy.da0a09de
NANO-Antivirus	Trojan.Win32.Renamer.lloxl
ViRobot	Backdoor.Win32.A.Banito.679587
Rising	Backdoor.Win32.Deflate.ag (CLASSIC)
Emsisoft	Gen:Variant.Graftor.1398 (B)
Baidu	Win32.Backdoor.Gpigeon2010.a
F-Secure	Malware.W32/Agent.EA
DrWeb	BackDoor.Bandito.2214
Zillya	Downloader.Unruy.Win32.2883
TrendMicro	TROJ_UNRUY.SMKV
Trapmine	suspicious.low.ml.score
Sophos	Mal/Generic-S
Jiangmin	Backdoor/Banito.ags
Webroot	W32.Trojan.Gen
Avira	W32/Agent.EA
MAX	malware (ai score=84)
Antiy-AVL	Trojan[Backdoor]/Win32.Banito
Kingsoft	Win32.AtInfect.lx.720668
Microsoft	TrojanDownloader:Win32/Unruy!pz
Xcitium	TrojWare.Win32.Agent.QTV@4pnpwk
Arcabit	Trojan.Graftor.D576
ZoneAlarm	HEUR:Trojan.Win32.Generic
GData	Win32.Trojan.PSE.1W2RGEU
Varist	W32/Backdoor.K.gen!Eldorado
McAfee	Downloader-BZH.gen.a
DeepInstinct	MALICIOUS
VBA32	BScope.Trojan.TE.01527
Malwarebytes	Generic.Malware.AI.DDS
Panda	Trj/Genetic.gen
TrendMicro-HouseCall	TROJ_UNRUY.SMKV
Tencent	Trojan.Win32.Banito.a
Ikarus	Trojan.Win32.Obfuscated
MaxSecure	Virus.W32.Renamer.E
Fortinet	W32/Obfuscated.NEZ!tr
AVG	Win32:Unruy-N [Trj]
Cybereason	malicious.8d7e3e
Avast	Win32:Unruy-N [Trj]

How to remove TrojanDownloader:Win32/Unruy!pz?

TrojanDownloader:Win32/Unruy!pz removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X