Trojan:Win32/Ursnif!MSR malicious file

The Trojan:Win32/Ursnif!MSR is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan:Win32/Ursnif!MSR virus can do?

• Executable code extraction
• Creates RWX memory
• Attempts to connect to a dead IP:Port (8 unique times)
• At least one IP Address, Domain, or File Name was found in a crypto call
• Performs some HTTP requests
• Attempts to create or modify system certificates
• Anomalous binary characteristics

Related domains:

How to determine Trojan:Win32/Ursnif!MSR?

File Info:
crc32: FE57D522
md5: 1cbb6664b6b7ef50cf279f372c60a00e
name: upload_file
sha1: 7f546c64bfc62dca6fdb2fecf916c2a0b930297d
sha256: 8131a4efe8cd0df08b0dc44a83079aa0dd7cf88c39c85f5caa13b43a950f9a9b
sha512: 749e13d54df19c95d93e763dd85e34e611bb59255717840102c59332cb3768ac5d1d8718130a6ed33cbdc1ac3686de64dada88de9a1af1af11d62cb247315f20
ssdeep: 3072:2JMBwm63FIC7EM4XUBU6hYTBbuDJ9PWPYdc6cNPprJB+MnR5XJwLOjx:lx6v+wYVqd9eAdJcfr1
type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: Copyright xa9 1998-2012 Send SightDanger, Inc.
InternalName: Joy Boy up
FileVersion: 7.6.3 ran-ge
CompanyName: Send SightDanger
ProductName: Send SightDanger instant
ProductVersion: 7.6.3
FileDescription: Joy Boy up
OriginalFilename: Live.dll
Translation: 0x0409 0x04b0

Trojan:Win32/Ursnif!MSR also known as:

How to remove Trojan:Win32/Ursnif!MSR?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.