Trojan:Win32/Ursnif!MTB (file analysis)

The Trojan:Win32/Ursnif!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan:Win32/Ursnif!MTB virus can do?

Anomalous binary characteristics

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine Trojan:Win32/Ursnif!MTB?


File Info:
crc32: 9BFA7AB6
md5: 81c7d6315216084c0f26590c297a4717
name: 4.exe
sha1: baefd4b3ef79fb96ff57ebc1d8df7f25d835bdc8
sha256: bba3fa36573554640ba51963873cb7530d21cb5ecd0b865b1c4d8a1091899571
sha512: 9612bbcfb2c5eed8f585d8447a573be72952baa1a32df564ea54433cddc7de2f2bfdd9ddc675eb895414d6aa3301f1ce53fa01412a6c1cd03055fca05f367e49
ssdeep: 3072:lKBZocfgH9+yoIlLB9YnDTHU9ht14Tx4jy1yOf:MZjmllonnev1mzf
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
FileVersion: 1.0.0.1
ProductVersion: 1.0.0.1
Translation: 0x0339 0x04b0

Trojan:Win32/Ursnif!MTB also known as:

MicroWorld-eScan	Gen:Variant.Strictor.178488
CAT-QuickHeal	TrojanSpy.Ursnif
McAfee	RDN/Generic.dx
Cylance	Unsafe
BitDefender	Gen:Variant.Strictor.178488
K7GW	Trojan ( 005427a31 )
K7AntiVirus	Trojan ( 005427a31 )
TrendMicro	TROJ_GEN.F0C2C00KT18
NANO-Antivirus	Trojan.Win32.Ursnif.fksimf
Symantec	Packed.Generic.525
TrendMicro-HouseCall	TrojanSpy.Win32.FAREIT.SMKC.hp
Paloalto	generic.ml
GData	Gen:Variant.Strictor.178488
Kaspersky	Trojan-Spy.Win32.Ursnif.afbo
Tencent	Win32.Trojan-spy.Ursnif.Eanf
Ad-Aware	Gen:Variant.Strictor.178488
Sophos	Mal/Kryptik-DD
Comodo	TrojWare.Win32.Ransom.Blocker.AF@7yarbp
F-Secure	Gen:Variant.Strictor.178488
DrWeb	Trojan.Packed2.41404
Zillya	Trojan.Ursnif.Win32.4456
Invincea	heuristic
McAfee-GW-Edition	BehavesLike.Win32.Dropper.ch
Trapmine	malicious.high.ml.score
Emsisoft	Gen:Variant.Strictor.178488 (B)
Cyren	W32/Trojan.DFTQ-4345
Webroot	W32.Adware.Gen
Avira	HEUR/AGEN.1037447
Antiy-AVL	Trojan[Spy]/Win32.Ursnif
Microsoft	Trojan:Win32/Ursnif!MTB
Endgame	malicious (high confidence)
ZoneAlarm	Trojan-Spy.Win32.Ursnif.afbo
AhnLab-V3	Trojan/Win32.Agent.C2869122
Acronis	suspicious
VBA32	BScope.Trojan.Fuery
ALYac	Gen:Variant.Strictor.178488
Malwarebytes	Trojan.MalPack.GS
Panda	Trj/GdSda.A
Arcabit	Trojan.Strictor.D2B938
ESET-NOD32	a variant of Win32/Kryptik.GNGU
Rising	Trojan.Kryptik!1.B4FF (CLASSIC)
Ikarus	Trojan-Downloader.Win32.SmokeLoader
Fortinet	W32/Kryptik.GNGU!tr
AVG	Win32:Malware-gen
Cybereason	malicious.152160
Avast	Win32:Malware-gen
CrowdStrike	malicious_confidence_100% (W)
Qihoo-360	Win32/Trojan.b48

How to remove Trojan:Win32/Ursnif!MTB?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Trojan:Win32/Ursnif!MTB (file analysis)