Trojan:Win32/Urelas.EC!MTB removal guide

The Trojan:Win32/Urelas.EC!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan:Win32/Urelas.EC!MTB virus can do?

Sample contains Overlay data
Authenticode signature is invalid
Anomalous binary characteristics

How to determine Trojan:Win32/Urelas.EC!MTB?


File Info:
name: ED5C801E0043EA33F381.mlw
path: /opt/CAPEv2/storage/binaries/35da468978d56e1dc6ce2be9a2111b7b4f58b4e03a9263d5e626c0162c04ce48
crc32: F168F306
md5: ed5c801e0043ea33f38194ba6ceb86a3
sha1: 0ae33a8d4710ccb402c14f865ed91c7e830cdb78
sha256: 35da468978d56e1dc6ce2be9a2111b7b4f58b4e03a9263d5e626c0162c04ce48
sha512: 47d5c9385b66c740b37e9969c5a80d0e5a3d78c632172f17c669ef39d8c488c180331e20bab38684488716c762e2c09d32f61e35b9929177720695a55eb8a9f6
ssdeep: 6144:FiKUYaN9F948lx4MLNOtVFE7QISzqJBp:Fm5N7C8lqMs5+
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1B8F47C21B6408075E36907300857F6E44A6DAE391699E58FF7783E366E313D39B3728E
sha3_384: e543289d89b56420c1bbebfcf897074fb9c5a3123d902930d9435517ed171cec58eef4656854f65dc4f018543ed08f04
ep_bytes: 470383ee01c1e90283ef0183f90872b2
timestamp: 2013-09-04 13:31:47

Version Info:
0: [No Data]

Trojan:Win32/Urelas.EC!MTB also known as:

Bkav	W32.AIDetectMalware
MicroWorld-eScan	Gen:Variant.Zusy.467824
FireEye	Generic.mg.ed5c801e0043ea33
CAT-QuickHeal	Trojan.Urelas
Skyhigh	BehavesLike.Win32.Generic.bz
McAfee	GenericRXVS-VG!ED5C801E0043
Malwarebytes	Generic.Malware.AI.DDS
VIPRE	Gen:Variant.Zusy.467824
Sangfor	Trojan.Win32.Save.a
BitDefender	Gen:Variant.Zusy.467824
CrowdStrike	win/malicious_confidence_100% (W)
BitDefenderTheta	Gen:NN.ZexaF.36792.SmZ@aeA4nrp
VirIT	Trojan.Win32.Generic.CONR
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
APEX	Malicious
ClamAV	Win.Malware.Urelas-9645835-0
Kaspersky	UDS:Trojan.Win32.Wecod.all
Rising	Spyware.CardSpy!1.A1A8 (CLASSIC)
Emsisoft	Gen:Variant.Zusy.467824 (B)
Baidu	Win32.Trojan.Urelas.d
DrWeb	Trojan.Siggen6.36651
Zillya	Trojan.Wecod.Win32.19033
Sophos	Generic ML PUA (PUA)
SentinelOne	Static AI – Malicious PE
MAX	malware (ai score=80)
GData	Win32.Trojan.PSE.102K66A
Google	Detected
Varist	W32/Urelas.DN.gen!Eldorado
Antiy-AVL	Trojan/Win32.Wecod
Kingsoft	malware.kb.a.990
Xcitium	Malware@#s0739i1p4oty
Arcabit	Trojan.Zusy.D72370
ZoneAlarm	UDS:Trojan.Win32.Wecod.all
Microsoft	Trojan:Win32/Urelas.EC!MTB
Cynet	Malicious (score: 100)
Acronis	suspicious
DeepInstinct	MALICIOUS
Cylance	unsafe
Tencent	Trojan.Win32.CardSpy.16000130
Ikarus	Trojan.Crypt
MaxSecure	Trojan.Malware.121218.susgen
Fortinet	W32/CardSpy.NAF!tr
AVG	Win32:Malware-gen
Cybereason	malicious.d4710c
Avast	Win32:Malware-gen

How to remove Trojan:Win32/Urelas.EC!MTB?

Trojan:Win32/Urelas.EC!MTB removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X