About “TrojanSpy:Win32/Ursnif.HV!bit” infection

Malware Removal

The TrojanSpy:Win32/Ursnif.HV!bit is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware - Review 2020

GridinSoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend to use GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the TRIAL period.
6-day free trial available.

What TrojanSpy:Win32/Ursnif.HV!bit virus can do?

  • Executable code extraction
  • Injection with CreateRemoteThread in a remote process
  • Creates RWX memory
  • Attempts to connect to a dead IP:Port (6 unique times)
  • Reads data out of its own binary image
  • A process created a hidden window
  • Drops a binary and executes it
  • The binary likely contains encrypted or compressed data.
  • Uses Windows utilities for basic functionality
  • Deletes its original binary from disk
  • Sniffs keystrokes
  • A system process is generating network traffic likely as a result of process injection
  • Network activity contains more than one unique useragent.
  • Installs itself for autorun at Windows startup
  • Attempts to modify proxy settings
  • Creates a copy of itself
  • Creates a slightly modified copy of itself
  • Anomalous binary characteristics

Related domains:

resolver1.opendns.com
myip.opendns.com

How to determine TrojanSpy:Win32/Ursnif.HV!bit?


File Info:

crc32: FC473CB0
md5: 55e303e02e1afe688e998b1cc2b5236f
name: 55E303E02E1AFE688E998B1CC2B5236F.mlw
sha1: 8e677266b0c5fc30872ce54710dbcf01246249a5
sha256: 6a8a72b18173d9e2e22a8e48c0be922a2cffdec12a5171780b8cf3fef3eed44b
sha512: b2e36cce4194d6ec08615f26d9440f63bca85c578f0794be6e6a717b0b0a5426aeafff9cec21d8311652c1c33bc39ff3f67bf932f8f0d85e217b243d2ebced4c
ssdeep: 12288:mOEHLFmDGRaJs+dl98pS0PX6jqqIswHJk+ClFE0Yd:mOspmDGRaK+aU0S2qIswHa+HN
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

0: [No Data]

TrojanSpy:Win32/Ursnif.HV!bit also known as:

BkavW32.AIDetect.malware1
K7AntiVirusSpyware ( 0053af711 )
Elasticmalicious (high confidence)
DrWebTrojan.PWS.Papras.2392
CynetMalicious (score: 100)
ALYacDeepScan:Generic.Ursnif.1.CFAC9705
CylanceUnsafe
ZillyaTrojan.Ursnif.Win32.2404
SangforTrojan.Win32.Save.a
CrowdStrikewin/malicious_confidence_100% (W)
K7GWPassword-Stealer ( 004c815b1 )
Cybereasonmalicious.02e1af
SymantecML.Attribute.HighConfidence
ESET-NOD32a variant of Win32/Spy.Ursnif.AO
APEXMalicious
AvastWin32:Ursnif-BF [Trj]
KasperskyHEUR:Trojan.Win32.Generic
BitDefenderDeepScan:Generic.Ursnif.1.CFAC9705
NANO-AntivirusTrojan.Win32.Papras.fbogvi
MicroWorld-eScanDeepScan:Generic.Ursnif.1.CFAC9705
TencentWin32.Trojan.Generic.Sxyh
Ad-AwareDeepScan:Generic.Ursnif.1.CFAC9705
SophosMal/Generic-S
BitDefenderThetaAI:Packer.B4604F931E
VIPRETrojan.Win32.Generic!BT
McAfee-GW-EditionBehavesLike.Win32.Sivis.tz
FireEyeGeneric.mg.55e303e02e1afe68
EmsisoftDeepScan:Generic.Ursnif.1.CFAC9705 (B)
SentinelOneStatic AI – Malicious PE
JiangminTrojan.Generic.akjpx
WebrootW32.Trojan.Gen
AviraTR/Crypt.XPACK.Gen3
eGambitUnsafe.AI_Score_91%
MicrosoftTrojanSpy:Win32/Ursnif.HV!bit
AegisLabTrojan.Win32.Generic.4!c
ZoneAlarmHEUR:Trojan.Win32.Generic
GDataDeepScan:Generic.Ursnif.1.CFAC9705
AhnLab-V3Trojan/Win32.Ursnif.C2211572
Acronissuspicious
McAfeeGenericRXBW-GV!55E303E02E1A
MAXmalware (ai score=100)
VBA32BScope.Trojan-Ransom.Foreign
MalwarebytesMalware.AI.3190687692
PandaTrj/CI.A
RisingBackdoor.Androm!8.113 (CLOUD)
YandexTrojan.GenAsa!0H4gDnKCxz8
IkarusTrojan-Banker.UrSnif
FortinetW32/Papras.EH!tr
AVGWin32:Ursnif-BF [Trj]
Paloaltogeneric.ml

How to remove TrojanSpy:Win32/Ursnif.HV!bit?

TrojanSpy:Win32/Ursnif.HV!bit removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

Leave a Comment