How to remove “Trojan:Win32/Ursnif.DA!MTB”?

The Trojan:Win32/Ursnif.DA!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan:Win32/Ursnif.DA!MTB virus can do?

The binary likely contains encrypted or compressed data.
Anomalous binary characteristics

How to determine Trojan:Win32/Ursnif.DA!MTB?


File Info:
crc32: F6BB2BC8
md5: 7acd4b671ce5ed5da44496e300774f3c
name: 7ACD4B671CE5ED5DA44496E300774F3C.mlw
sha1: 4cf7254e90a70ca6e03728e88fe8d120364c2d6e
sha256: 42f1067d67db4f6f2cc4ff46070551df1b460d4fc819f57b69601cd5ffff8b42
sha512: 5a22ff6815ab195d18cf8ad2c91e9410d3bba3c0a7d9a133738344e28d1409f3fb3de127b1c26d7eda98190f194d428d8488d30e671b6f14f69c788d05884f56
ssdeep: 3072:2zxr7pvt4FL+nRLMizXn1IiBCzaz/+x/nt2agAnTMibN5Pnd82IFb:2lr1v3RLMiTBCzaj+bPMibjnd82C
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
0: [No Data]

Trojan:Win32/Ursnif.DA!MTB also known as:

Bkav	W32.AIDetect.malware1
K7AntiVirus	Trojan ( 005085541 )
DrWeb	Trojan.PWS.Papras.2514
Cynet	Malicious (score: 100)
ALYac	Trojan.GenericKD.32120966
Cylance	Unsafe
Zillya	Trojan.Foreign.Win32.55898
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_90% (D)
BitDefender	Trojan.GenericKD.32120966
K7GW	Trojan ( 005085541 )
Cybereason	malicious.71ce5e
Symantec	Trojan.Gen
ESET-NOD32	a variant of Win32/Kryptik.FYHF
APEX	Malicious
Kaspersky	Trojan-Ransom.Win32.Foreign.nksb
Alibaba	Trojan:Win32/Foreign.030dd503
NANO-Antivirus	Trojan.Win32.RiskGen.emlykv
MicroWorld-eScan	Trojan.GenericKD.32120966
Tencent	Malware.Win32.Gencirc.11691978
Ad-Aware	Trojan.GenericKD.32120966
Comodo	Malware@#2w817yzj5fe2y
TrendMicro	Mal_MiliCry-1h
McAfee-GW-Edition	BehavesLike.Win32.Generic.cc
FireEye	Generic.mg.7acd4b671ce5ed5d
Emsisoft	Trojan.GenericKD.32120966 (B)
SentinelOne	Static AI – Malicious PE
eGambit	Unsafe.AI_Score_99%
Microsoft	Trojan:Win32/Ursnif.DA!MTB
Arcabit	Trojan.Generic.D1EA2086
AegisLab	Trojan.Win32.Foreign.4!c
GData	Trojan.GenericKD.32120966
TACHYON	Ransom/W32.Foreign.196608
Acronis	suspicious
McAfee	Artemis!7ACD4B671CE5
MAX	malware (ai score=100)
VBA32	Hoax.Foreign
TrendMicro-HouseCall	Mal_MiliCry-1h
Rising	Ransom.Foreign!8.292 (CLOUD)
Ikarus	Trojan-Ransom.Foreign
Fortinet	W32/Generic.AP.1C42A7E!tr
Paloalto	generic.ml
Qihoo-360	Win32/Trojan.Foreign.HgIASOYA

How to remove Trojan:Win32/Ursnif.DA!MTB?

Trojan:Win32/Ursnif.DA!MTB removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X