Spy • Trojan

What is “TrojanSpy:Win32/Ursnif.HN”?

Malware Removal

The TrojanSpy:Win32/Ursnif.HN is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What TrojanSpy:Win32/Ursnif.HN virus can do?

  • Executable code extraction
  • Compression (or decompression)
  • Injection with CreateRemoteThread in a remote process
  • Creates RWX memory
  • Expresses interest in specific running processes
  • Reads data out of its own binary image
  • A process created a hidden window
  • Unconventionial language used in binary resources: Portuguese
  • Uses Windows utilities for basic functionality
  • Code injection with CreateRemoteThread in a remote process
  • Deletes its original binary from disk
  • Attempts to identify installed AV products by registry key
  • Checks the CPU name from registry, possibly for anti-virtualization

How to determine TrojanSpy:Win32/Ursnif.HN?



File Info:

crc32: 0817C5C9
md5: ce5eec826c9e0819e82b457bbd4cf770
name: CE5EEC826C9E0819E82B457BBD4CF770.mlw
sha1: 8b10d8a6dd8d9d998036f515335df2644cf65b27
sha256: 01367c248a86f9f527f8c895d724bf2443aae9217129ee20931d7384c882678e
sha512: 868abef2a4173ae4a4e6e7fdf146a8ead3fa7097a62f1094e1aa4a487d06ff582597e8ee6425a4d1865bc3ba7dd0a950d2497f8f9c45959f1c7d532e105ef928
ssdeep: 6144:7gfZhqPjEH3U+9cq7CXLVhMaz9QZNR/tfK86:7MeC35cRrMt/tc
type: PE32 executable (GUI) Intel 80386, for MS Windows


Version Info:

LegalCopyright: Copyright xa9 2010
InternalName: Increase
FileVersion: 56, 202, 194, 215
CompanyName: Data Dynamics
PrivateBuild: Hollows
LegalTrademarks: Lowering
ProductName: Imperfection Nationalised
SpecialBuild: 218, 220, 17, 249
ProductVersion: 166, 91, 241, 169
FileDescription: Jetted
OriginalFilename: Hermits.exe

TrojanSpy:Win32/Ursnif.HN also known as:

BkavW32.AIDetect.malware1
K7AntiVirusRiskware ( 0040eff71 )
Elasticmalicious (high confidence)
DrWebBackDoor.Gootkit.182
CynetMalicious (score: 100)
ALYacTrojan.TeslaCrypt.Gen.4
CylanceUnsafe
ZillyaTrojan.CryptGen.Win32.1
SangforTrojan.Win32.Save.a
CrowdStrikewin/malicious_confidence_80% (D)
K7GWRiskware ( 0040eff71 )
Cybereasonmalicious.26c9e0
SymantecTrojan.Gen
ESET-NOD32a variant of Win32/Kryptik.EMER
APEXMalicious
AvastWin32:Malware-gen
KasperskyHEUR:Trojan.Win32.Generic
BitDefenderTrojan.TeslaCrypt.Gen.4
NANO-AntivirusTrojan.Win32.Waldek.ebwfkx
MicroWorld-eScanTrojan.TeslaCrypt.Gen.4
TencentWin32.Trojan.Waldek.Tapa
Ad-AwareTrojan.TeslaCrypt.Gen.4
SophosML/PE-A + Mal/Ransom-EG
BitDefenderThetaGen:NN.ZexaF.34628.qq2@aqUhXqiG
VIPRETrojan.Win32.Generic!BT
TrendMicroRansom_HPLOCKY.SM1
McAfee-GW-EditionArtemis!Trojan
FireEyeGeneric.mg.ce5eec826c9e0819
EmsisoftTrojan.TeslaCrypt.Gen.4 (B)
SentinelOneStatic AI – Suspicious PE
JiangminTrojan.Waldek.diu
AviraHEUR/AGEN.1120430
eGambitUnsafe.AI_Score_99%
Antiy-AVLTrojan/Win32.Waldek
MicrosoftTrojanSpy:Win32/Ursnif.HN
ArcabitTrojan.TeslaCrypt.Gen.4
AegisLabTrojan.Win32.Waldek.4!c
ZoneAlarmHEUR:Trojan.Win32.Generic
GDataTrojan.TeslaCrypt.Gen.4
AhnLab-V3Win-Trojan/Lockycrypt.Gen
McAfeeArtemis!CE5EEC826C9E
MAXmalware (ai score=81)
VBA32BScope.TrojanDownloader.Talalpek
PandaTrj/Agent.PS
TrendMicro-HouseCallRansom_HPLOCKY.SM1
RisingTrojan.Waldek!8.E6B (CLOUD)
YandexTrojan.Waldek!PLKM2G7jE3A
IkarusTrojan-Spy.Agent
FortinetW32/Kryptik.EQFZ!tr
AVGWin32:Malware-gen
Paloaltogeneric.ml
Qihoo-360Win32/TrojanPSW.Gozi.HwcBEpsA

How to remove TrojanSpy:Win32/Ursnif.HN?

TrojanSpy:Win32/Ursnif.HN removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment