TrojanSpy:Win64/Ursnif.A

By Sumo3000 in Trojans

Threat Scorecard

Ranking:	17,361
Threat Level:	80 % (High)
Infected Computers:	9,123

First Seen:	December 12, 2011
Last Seen:	September 7, 2023
OS(es) Affected:	Windows

TrojanSpy:Win64/Ursnif.A is a Trojan that contains spyware functionalities enabling an attacker to obtain backdoor access and control of the corrupted PC. When installed on the affected computer, TrojanSpy:Win64/Ursnif.A steals confidential information and transfers it to remote attackers. TrojanSpy:Win64/Ursnif.A may be installed on the infected computer via drive-by download attacks, if the PC user visits a compromised or infected website. TrojanSpy:Win64/Ursnif.A may also be installed by other malware infections. TrojanSpy:Win64/Ursnif.A connects to a remote server to get instructional commands from remote attackers. TrojanSpy:Win64/Ursnif.A captures FTP transfer data (GET/PUT commands) and HTTP outbound traffic (POST data), gets your browser cookies and digital certificates, takes screenshots, deletes browser cookies, and fulfills numerous other harmful activities. TrojanSpy:Win64/Ursnif.A embeds itself into the genuine web browser processes.

Table of Contents

Aliases

15 security vendors flagged this file as malicious.

Anti-Virus Software	Detection
Fortinet	W32/Ursnif.PEM!tr
Microsoft	TrojanSpy:Win32/Ursnif.gen!K
McAfee-GW-Edition	Artemis!E67E824460B5
AntiVir	TR/Spy.Ursnif.K.168
Sophos	Mal/Generic-S
BitDefender	Trojan.GenericKDV.1065624
Kaspersky	Trojan-Spy.Win32.Ursnif.pem
McAfee	RDN/Generic PWS.y!ta
Avast	Win32:Crypt-NWY [Trj]
Fortinet	W32/Ursnif.B!tr
McAfee	PWS-FADX!594091811002
Fortinet	W32/Papras.FGI!tr.bdr
AntiVir	TR/Crypt.XPACK.Gen3
Kaspersky	Trojan-Spy.Win32.Ursnif.b
McAfee	PWS-FADX!0603BF770C11

SpyHunter Detects & Remove TrojanSpy:Win64/Ursnif.A

File System Details

TrojanSpy:Win64/Ursnif.A may create the following file(s):

Expand All | Collapse All

#	File Name	MD5	Detections Detections: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
1.	n.	694cfd39050fafb121bc7250c8b7ad45	42
Name: n. MD5: 694cfd39050fafb121bc7250c8b7ad45 Size: 59.39 KB (59392 bytes) Detections: 42 Path: %SystemDrive%\RECYCLER\S-1-5-21-842925246-1450960922-1801674531-1003\$f0f98dd8d3abadbdf1b04d8800d0764b Group: Malware file Last Updated: January 14, 2013
2.	wsearch.exe	013f153b253b33a88317aa77ead9e52b	30
Name: wsearch.exe MD5: 013f153b253b33a88317aa77ead9e52b Size: 416.25 KB (416256 bytes) Detections: 30 Type: Executable File Path: %LOCALAPPDATA%\WideSearch Group: Malware file Last Updated: January 8, 2013
3.	wsearch.exe	33bc73c20f9c0f786bc7ff32a97ba700	25
Name: wsearch.exe MD5: 33bc73c20f9c0f786bc7ff32a97ba700 Size: 416.25 KB (416256 bytes) Detections: 25 Type: Executable File Path: %LOCALAPPDATA%\WideSearch Group: Malware file Last Updated: January 8, 2013
4.	dfrgWWIN.dll	e67e824460b5b08800efa713ba4b1dff	25
Name: dfrgWWIN.dll MD5: e67e824460b5b08800efa713ba4b1dff Size: 222.2 KB (222208 bytes) Detections: 25 Type: Dynamic link library Path: %WINDIR% Group: Malware file Last Updated: May 26, 2022
5.	Nbt.exe	74d81e494f2bca0785f1327eca65c851	18
Name: Nbt.exe MD5: 74d81e494f2bca0785f1327eca65c851 Size: 776.19 KB (776192 bytes) Detections: 18 Type: Executable File Path: %APPDATA%\Nbt Group: Malware file Last Updated: January 8, 2013
6.	zdbvdzw.dll	1d46d5e87cbc5b6d1c8e5a5e7024f658	13
Name: zdbvdzw.dll MD5: 1d46d5e87cbc5b6d1c8e5a5e7024f658 Size: 269.31 KB (269312 bytes) Detections: 13 Type: Dynamic link library Path: %USERPROFILE%\Local Settings\Application Data\Coupon Companion\Adobe Group: Malware file Last Updated: January 8, 2013
7.	f91158992.exe	9fa47a30818710e86b0880d20b07355e	10
Name: f91158992.exe MD5: 9fa47a30818710e86b0880d20b07355e Size: 425.98 KB (425984 bytes) Detections: 10 Type: Executable File Path: C:\Users\<username>\Downloads\testdisk-7.2-WIP\recup_dir.23\f91158992.exe Group: Malware file Last Updated: November 28, 2022
8.	slwljjvb.dll	670cfaeaa9fe0abfe9cc91f4d1cbf5d9	10
Name: slwljjvb.dll MD5: 670cfaeaa9fe0abfe9cc91f4d1cbf5d9 Size: 291.84 KB (291840 bytes) Detections: 10 Type: Dynamic link library Path: %LOCALAPPDATA%\Microsoft\HuluDesktop Group: Malware file Last Updated: January 14, 2013
9.	qbjmd.dll	26aa65f55cf06b6f1bb1940c3d250b14	7
Name: qbjmd.dll MD5: 26aa65f55cf06b6f1bb1940c3d250b14 Size: 208.89 KB (208896 bytes) Detections: 7 Type: Dynamic link library Path: %LOCALAPPDATA%\Stronghold_LLC\SoftGrid Client Group: Malware file Last Updated: January 21, 2013
10.	Nbt.exe	60627b628b732ddabee0aaa4b0d4ba8e	5
Name: Nbt.exe MD5: 60627b628b732ddabee0aaa4b0d4ba8e Size: 720.38 KB (720384 bytes) Detections: 5 Type: Executable File Path: %APPDATA%\Nbt Group: Malware file Last Updated: January 8, 2013
11.	svcnost.exe	a6f5a07088ea4f0c7f40fdc1361fc045	5
Name: svcnost.exe MD5: a6f5a07088ea4f0c7f40fdc1361fc045 Size: 250.36 KB (250368 bytes) Detections: 5 Type: Executable File Path: %APPDATA%\xclw3zeup1cqkruh3uvw1populzbp3mu Group: Malware file Last Updated: January 8, 2013
12.	autoexec64.dll	ad33f4584e1d6a2be98cea08de2b8f63	2
Name: autoexec64.dll MD5: ad33f4584e1d6a2be98cea08de2b8f63 Size: 68.6 KB (68608 bytes) Detections: 2 Type: Dynamic link library Path: %TEMP% Group: Malware file Last Updated: March 1, 2013
13.	smss.exe	522bb21a447c46ed17765ef80f56f2d0	1
Name: smss.exe MD5: 522bb21a447c46ed17765ef80f56f2d0 Size: 218.11 KB (218112 bytes) Detections: 1 Type: Executable File Path: %SystemDrive%\system32 Group: Malware file Last Updated: January 8, 2013
14.	pkms.exe	ed07df1a68f1b36055dbeebfb77383fb	1
Name: pkms.exe MD5: ed07df1a68f1b36055dbeebfb77383fb Size: 286.2 KB (286208 bytes) Detections: 1 Type: Executable File Path: %USERPROFILE% Group: Malware file Last Updated: January 8, 2013
15.	RevoHack.dll	52c1309cbb99532af537af0ae62aaa86	1
Name: RevoHack.dll MD5: 52c1309cbb99532af537af0ae62aaa86 Size: 727.55 KB (727552 bytes) Detections: 1 Type: Dynamic link library Path: %USERPROFILE%\My Documents\Downloads\Compressed\PremiumhackDragonNest Group: Malware file Last Updated: January 8, 2013
16.	RevoHack.dll	063148b684125bb95b9e5e49d5baff83	1
Name: RevoHack.dll MD5: 063148b684125bb95b9e5e49d5baff83 Size: 842.75 KB (842752 bytes) Detections: 1 Type: Dynamic link library Path: %USERPROFILE%\My Documents\Downloads\Compressed\TrialWinXP Group: Malware file Last Updated: January 8, 2013
17.	RevoHack.dll	beee1db6dd40d62ec2ba98d47d98f72b	1
Name: RevoHack.dll MD5: beee1db6dd40d62ec2ba98d47d98f72b Size: 728.06 KB (728064 bytes) Detections: 1 Type: Dynamic link library Path: %USERPROFILE%\My Documents\Downloads\Compressed\RevoHack Premium 24September2012 Group: Malware file Last Updated: January 8, 2013
18.	lxbfmote64.dll	175ce484e7d657938a58c61753fa9267	1
Name: lxbfmote64.dll MD5: 175ce484e7d657938a58c61753fa9267 Size: 93.18 KB (93184 bytes) Detections: 1 Type: Dynamic link library Path: %ALLUSERSPROFILE% Group: Malware file Last Updated: April 29, 2013
19.	makepugc64.dll	12732b35e36e5877be63fcb8468241d6	1
Name: makepugc64.dll MD5: 12732b35e36e5877be63fcb8468241d6 Size: 67.07 KB (67072 bytes) Detections: 1 Type: Dynamic link library Path: %WINDIR% Group: Malware file Last Updated: April 16, 2013
20.	ciphgMgr64.dll	985158c0878d3f82baad0c676d847fc2	1
Name: ciphgMgr64.dll MD5: 985158c0878d3f82baad0c676d847fc2 Size: 67.07 KB (67072 bytes) Detections: 1 Type: Dynamic link library Path: %WINDIR%\system32 Group: Malware file Last Updated: January 16, 2013
21.	cleadkey64.dll	1c64a7cfa237a25514b4c7869854541b	1
Name: cleadkey64.dll MD5: 1c64a7cfa237a25514b4c7869854541b Size: 67.07 KB (67072 bytes) Detections: 1 Type: Dynamic link library Path: %WINDIR%\system32 Group: Malware file Last Updated: April 29, 2013
22.	runadctr64.dll	6ca30479837f7bbf4ddbc2af728a77ef	1
Name: runadctr64.dll MD5: 6ca30479837f7bbf4ddbc2af728a77ef Size: 69.63 KB (69632 bytes) Detections: 1 Type: Dynamic link library Path: %WINDIR%\system32 Group: Malware file Last Updated: April 16, 2013
23.	cmdkmsdt64.dll	cc63230b29a0637fff28102b428def81	1
Name: cmdkmsdt64.dll MD5: cc63230b29a0637fff28102b428def81 Size: 72.7 KB (72704 bytes) Detections: 1 Type: Dynamic link library Path: %WINDIR%\system32 Group: Malware file Last Updated: March 29, 2013
24.	ReAgvate64.dll	f30a1f02f85145d5efeab5a45e6728e0	1
Name: ReAgvate64.dll MD5: f30a1f02f85145d5efeab5a45e6728e0 Size: 72.19 KB (72192 bytes) Detections: 1 Type: Dynamic link library Path: %WINDIR%\system32 Group: Malware file Last Updated: April 8, 2013