Threat Database Trojans Trojan:Win32/Urelas.C

Trojan:Win32/Urelas.C

By Sumo3000 in Trojans

Threat Scorecard

Ranking: 11,321
Threat Level: 80 % (High)
Infected Computers: 3,636
First Seen: December 7, 2012
Last Seen: September 14, 2023
OS(es) Affected: Windows

Trojan:Win32/Urelas.C is a Trojan that has capability of monitoring specific card game applications and transfers screenshots and information about a targeted PC to a remote server. Trojan:Win32/Urelas.C also drops and installs other malware infections on the affected computer. While being installed, Trojan:Win32/Urelas.C makes system changes by downloading malevolent files and modifying the Windows Registry. PC users may accidentally download Trojan:Win32/Urelas.C, thinking it is software connected with a card game. Trojan:Win32/Urelas.C is able to control the processes that are components of specific card games.

SpyHunter Detects & Remove Trojan:Win32/Urelas.C

File System Details

Trojan:Win32/Urelas.C may create the following file(s):
# File Name MD5 Detections
1. awopk.exe c5a65490ab06ce30b1ca4a7afd0bea22 4
2. fekiw.exe ab106d99f3cc0064bfb9bf59b215ea45 2
3. \MkUpdate.exe
4. \setup.exe
5. lyycofez.exe
6. %TEMP%\_uninsep.bat
7. lymucexuc.dll
8. \gbp.ini
9. \golfinfo.ini
10. 7ZSfxNew.exe b829e686d0e252f6be5c197f156c6745 0
11. a4240542d114fb332e81efde95a61434 a4240542d114fb332e81efde95a61434 0
12. ebb3f1255cc4e93bf214050eb6b3f43a ebb3f1255cc4e93bf214050eb6b3f43a 0
13. 028e31efbe9f6c149fdc45e4c871dc75 028e31efbe9f6c149fdc45e4c871dc75 0
14. d926a99bf8b332254ac0f3b05ae354ab d926a99bf8b332254ac0f3b05ae354ab 0
15. File.exe c0cf36675be9d874fc661e67ced26ba1 0
16. ctfmom.exe 4ec7b4a820ab08dbef615fc889e9b1f5 0

Registry Details

Trojan:Win32/Urelas.C may create the following registry entry or registry entries:
Regexp file mask
%TEMP%\_uinsey.bat
%TEMP%\golfinfo.ini
%TEMP%\hotez.exe
"HKEY_LOCAL_MACHINE\SOFTWARE\SYSTEM\CurrentControlSet\Services\Jiuswan\Parameters "ServiceDll" = "\.dll", for example "C:\Windows\System32\lymucexuc.dll"
HKEY_LOCAL_MACHINE\SOFTWARE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost "", for example "Hiceegdiyfp" = "", for example "Jiuswan" HKEY_LOCAL_MACHINE\SOFTWARE\SYSTEM\CurrentControlSet\Services\\Parameters, for example

Trending

Most Viewed

Loading...