Trojan:Win32/Ulise.AMS!MTB information

The Trojan:Win32/Ulise.AMS!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan:Win32/Ulise.AMS!MTB virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Sample contains Overlay data
• Uses Windows utilities for basic functionality
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Uses Windows utilities to create a scheduled task
• Creates a copy of itself
• Deletes executed files from disk
• Uses suspicious command line tools or Windows utilities
• Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Trojan:Win32/Ulise.AMS!MTB?

File Info:
name: F6C3078D126EAC384B26.mlw
path: /opt/CAPEv2/storage/binaries/f7dab04ebe1e355414cd636c492a7958f45757299c1cab04a4bc5654c1b8cfdb
crc32: 113F0B04
md5: f6c3078d126eac384b26209dfca70f67
sha1: 69a60c892b90dece339c768116e3567aee43ea18
sha256: f7dab04ebe1e355414cd636c492a7958f45757299c1cab04a4bc5654c1b8cfdb
sha512: 479faa86ec4769a843d0fc4c6138bcb2fa3c2b412d8ecf905f6cba43d55d89497653624cdca4ec78322d77e0f51e217f496f244d25d10d79efca4b7410f26114
ssdeep: 6144:Y3O9PuvzFeBj2j1Z8NuPLWFnTk8uS6cxae1xUxGqogkM41O:Y3OQvABj2jHJYnTfYWU0jK41
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T11174D06FB2051B32C39103B33B1A5DC5AB1995F5326A85D0506CC0DC2396ADB9FBB39E
sha3_384: b764b85c3d84b12371cbb7a28ff86be19af7e7b6768687f771c7c32826587a77d96d48a3d52835dd56a8951151c790e3
ep_bytes: 68000000008b1c2483c4045081ee4dd0
timestamp: 1975-06-24 00:00:00

Version Info:
0: [No Data]

Trojan:Win32/Ulise.AMS!MTB also known as:

How to remove Trojan:Win32/Ulise.AMS!MTB?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.