Trojan:Win32/Urelas!pz malicious file

The Trojan:Win32/Urelas!pz is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan:Win32/Urelas!pz virus can do?

Unconventionial language used in binary resources: Korean
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid
Anomalous binary characteristics

How to determine Trojan:Win32/Urelas!pz?


File Info:
name: FB5F8E0CDD9767626184.mlw
path: /opt/CAPEv2/storage/binaries/6605ec723fbb39a8d537a51cb8b0e5a8b200fdf69e7c44c93d9d8e3e707e3efe
crc32: DB745187
md5: fb5f8e0cdd97676261846ea6fad89952
sha1: d2f2bf739d086de69ba706f337f32daed9e328ba
sha256: 6605ec723fbb39a8d537a51cb8b0e5a8b200fdf69e7c44c93d9d8e3e707e3efe
sha512: e60cb70c9c4326bb94326ad93df309598cfc773ee6acfc4604e4deb5a1e7757d9c0c5c0c8090982db6582deea3c08167afc164af5a47dc78afecbb814317acee
ssdeep: 3072:IFi/q9Q33Kad65f3NTEBevoIpaUMPVnzv:IAq9Q3Xcfkevo2rMPVnz
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1F6248C22F9008031F1E10A35919E3FF50EBD8F2E13E9D6C74B64752AAF715D2AA39247
sha3_384: b7eeafe67e808e208434b5c7ac5ff2d4d58f25ad5ec3af56157613ed91057d6c8c1876ee9432b735a62751943984d9ed
ep_bytes: 60e803000000e9eb045d4555c3e80100
timestamp: 2013-11-21 13:52:42

Version Info:
0: [No Data]

Trojan:Win32/Urelas!pz also known as:

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Generic.4!c
Elastic	Windows.Generic.Threat
Cynet	Malicious (score: 100)
FireEye	Generic.mg.fb5f8e0cdd976762
Skyhigh	BehavesLike.Win32.Generic.dt
McAfee	Artemis!FB5F8E0CDD97
Cylance	unsafe
Sangfor	Trojan.Win32.Agent.Veem
Alibaba	Trojan:Win32/Urelas.ddb4ea30
Cybereason	malicious.cdd976
Arcabit	Trojan.Barys.D64C29
BitDefenderTheta	AI:Packer.E07834DF20
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
BitDefender	Gen:Variant.Barys.412713
MicroWorld-eScan	Gen:Variant.Barys.412713
Avast	Win32:SpywareX-gen [Trj]
Emsisoft	Gen:Variant.Barys.412713 (B)
F-Secure	Heuristic.HEUR/AGEN.1366536
VIPRE	Gen:Variant.Barys.412713
Sophos	Generic ML PUA (PUA)
Ikarus	Trojan-PWS.Banker6
Google	Detected
Avira	HEUR/AGEN.1366536
Kingsoft	malware.kb.a.1000
Microsoft	Trojan:Win32/Urelas!pz
GData	Win32.Trojan.PSE.13IJRMU
AhnLab-V3	Backdoor/Win32.Plite.C219662
ALYac	Gen:Variant.Barys.412713
MAX	malware (ai score=87)
Malwarebytes	CardSpy.Spyware.Stealer.DDS
SentinelOne	Static AI – Malicious PE
Fortinet	W32/CardSpy.PRKJ!tr
AVG	Win32:SpywareX-gen [Trj]
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_90% (D)
alibabacloud	VirTool:Win/Obfuscate.FakeEp.DYN(dyn)

How to remove Trojan:Win32/Urelas!pz?

Trojan:Win32/Urelas!pz removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X