Threat Database Trojans Trojan.Spy.Ursnif

Trojan.Spy.Ursnif

By CagedTech in Trojans
Published:
Last updated:

Threat Scorecard

Threat Level: 80 % (High)
Infected Computers: 422
First Seen: November 30, 2010
Last Seen: November 23, 2018
OS(es) Affected: Windows

The detection of Trojan.Spy.Ursnif on your system indicates a potential security threat. This type of malware is designed to spy on your computer activities, steal sensitive information, and compromise your system's security. It is essential to understand the nature of this threat and take immediate action to remove it and prevent further damage.

What Is Trojan.Spy.Ursnif?

Trojan.Spy.Ursnif is a type of spyware that can infect your computer without your knowledge or consent. Its primary purpose is to gather sensitive information, such as login credentials, credit card numbers, and other personal data. This malware can also install additional malicious software, create backdoors, and allow unauthorized access to your system.

How Trojan.Spy.Ursnif Operates

Once installed, Trojan.Spy.Ursnif can operate in stealth mode, making it difficult to detect. It can monitor your keyboard and mouse activities, capture screenshots, and transmit the collected data to its command and control servers. This malware can also exploit vulnerabilities in your system and applications to spread and infect other computers.

Symptoms of Infection

Identifying the symptoms of a Trojan.Spy.Ursnif infection can be challenging, as it is designed to remain hidden. However, you may notice unusual system behavior, such as slow performance, frequent crashes, or unexpected pop-ups. You may also receive warnings from your security software or notice that your personal data is being stolen or misused.

  • Unexplained changes to your system settings or configuration
  • Appearance of unfamiliar programs or icons
  • Increased network activity or suspicious data transmissions
  • Difficulty accessing certain websites or online services

How to Remove Trojan.Spy.Ursnif

  1. Boot your computer in Safe Mode with Networking to prevent the malware from loading and to allow for easier removal
  2. Perform a full scan of your system using a reputable anti-malware tool, such as SpyHunter, to detect and remove all instances of the malware
  3. Uninstall any suspicious programs or applications that may be related to the infection
  4. Reset your web browsers, including Chrome, Firefox, and Edge, to their default settings to remove any malicious extensions or add-ons
  5. Reboot your computer and perform another full scan to ensure that the malware has been completely removed

Conclusion

Removing Trojan.Spy.Ursnif from your system requires immediate attention and a thorough approach. By following the steps outlined above and taking proactive measures to secure your system, you can help prevent future infections and protect your sensitive information. It is essential to remain vigilant and continuously monitor your system for any signs of malware activity to ensure your computer and personal data remain safe.

Aliases

15 security vendors flagged this file as malicious.

Antivirus Vendor Detection
AntiVir TR/Kazy.67671.32
Kaspersky Backdoor.Win32.Papras.fut
AVG Generic32.AQYU
Fortinet W32/Kryptik.AYDA
AhnLab-V3 Trojan/Win32.Zbot
Sophos Mal/ZboCheMan-M
AntiVir TR/Spy.Ursnif.176
Symantec Trojan.Zbot
McAfee Artemis!ABACD922606B
AntiVir TR/Kazy.67671.30
Kaspersky Backdoor.Win32.Papras.fue
McAfee Artemis!B124A5E115B7
Avast Win32:Downloader-SYF [Trj]
McAfee RDN/Generic PWS.y!kb
AVG PSW.Generic11.BOO

File System Details

Trojan.Spy.Ursnif may create the following file(s):
# File Name MD5 Detections
1. drivecab.exe cb0c37db071299a26d1e90091e2c511d 11
2. PATHInit.exe 016369c4927cbbfb7a071ac6924d448c 2
3. FXSR2_32.exe 99be1d8a3fefca1247554cd67d609619 2
4. dfrgonce.dll 6f6ef9c0bdb81c5a5adbb42eec179afe 1
5. MigAutil.exe 85b1044e8e04d836ccdd92cb4b092c51 1
6. mstshost.dll 3a5a88d455f63844623c4c0a9431261a 1
7. chkddial.dll a93f34e00f4ba5cafafa6e8fc1b84794 1
8. icsudt32.dll 6ae9779010b3ed422fed1c6682103eca 1
9. dllhftp.exe abacd922606beec7c630de03ed5a4384 1
10. dialions.dll 265a5dc8920910b122359381244071ef 1
11. msfemsra.dll e3c68cebe73fc3f7dedd2382038fefa6 1
12. cmdmsra.exe f9a12fdb2a643d99c8fa30e9898275fd 1
13. 037627c4457d5862c73d9246b9208c2825c56d9bb1f254378ec920c1be55c13f.exe cb4a3e8887e08b8b3072c32305d41d37 1
14. 4cfa320b9c252c7ff5ba474a3ab81b42f55455b20ef2499196ca5fff3ccd1d63.exe 83e07bf5e594135d2fbf37c5cd12ddfe 1
15. file.dll 255a177c7777741f8d06fc3e45dd5ccc 0
16. 0ae059062d80daa2a11631bd453b2aa4 0ae059062d80daa2a11631bd453b2aa4 0
17. 3879cb077ce59e25605e74b3bba64eb8 3879cb077ce59e25605e74b3bba64eb8 0
18. 6b434fb8cc7a5085db7943dfb0a3ca13 6b434fb8cc7a5085db7943dfb0a3ca13 0
19. f0d8dafec7fcc6d1aaca107714959a7f f0d8dafec7fcc6d1aaca107714959a7f 0
20. b6562cb534ea11dd42f7ee069d29f22d b6562cb534ea11dd42f7ee069d29f22d 0
21. 4d10ec332aa4a7001d8b46c1230f74de 4d10ec332aa4a7001d8b46c1230f74de 0
22. dd8ea7d979aa3b723d8d92fe1b39c2bf dd8ea7d979aa3b723d8d92fe1b39c2bf 0
23. 88f81b2433070daca2c5b39aba972e34 88f81b2433070daca2c5b39aba972e34 0
24. 0d559e52129eff0176c4c582f7a3eb19 0d559e52129eff0176c4c582f7a3eb19 0
25. 64cf07e54db68646e5a63d329d08516a 64cf07e54db68646e5a63d329d08516a 0
26. file.exe 3cce22904c4e905144fa85219e38a763 0
27. 2ef23146836ead2012141e11be8e155c 2ef23146836ead2012141e11be8e155c 0
More files