TrojanSpy:Win64/Ursnif.AF

By Domesticus in Trojans

Threat Scorecard

Ranking:	18,741
Threat Level:	80 % (High)
Infected Computers:	4,295

First Seen:	April 2, 2013
Last Seen:	March 26, 2024
OS(es) Affected:	Windows

TrojanSpy:Win64/Ursnif.AF is a deceptive Trojan horse threat. The TrojanSpy:Win64/Ursnif.AF threat may be loaded and run without any indication to the computer user. When this takes place, TrojanSpy:Win64/Ursnif.AF may open up a port where a remote attacker could gain entry into the infected computer. This access could result in identity theft or other serious issues. Removing TrojanSpy:Win64/Ursnif.AF

is the only sure way of preventing a system from become vulnerable to remote attacks.

Table of Contents

Aliases

15 security vendors flagged this file as malicious.

Anti-Virus Software	Detection
Kaspersky	not-a-virus:Monitor.Win32.KeyLogger.bdy
Panda	Adware/BaiduBar
AVG	Generic4.NLP
Ikarus	not-a-virus:AdWare.Win32.Agent
AhnLab-V3	Win-AppCare/Xema.294912.R
Microsoft	Adware:Win32/DoubleD
Antiy-AVL	AdWare/Win32.Agent.gen
AntiVir	ADSPY/Agent.pkv
BitDefender	Application.Generic.237274
Kaspersky	not-a-virus:AdWare.Win32.Agent.pkv
Avast	Win32:Adware-gen
F-Prot	W32/MalwareS.IYS
K7AntiVirus	Adware
CAT-QuickHeal	AdWare.Agent.pkv (Not a Virus)
AVG	MSIL.DTP

SpyHunter Detects & Remove TrojanSpy:Win64/Ursnif.AF

File System Details

TrojanSpy:Win64/Ursnif.AF may create the following file(s):

Expand All | Collapse All

#	File Name	MD5	Detections Detections: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
1.	iehighutil.exe	75bd6e532370c06c567718d68e551647	28
Name: iehighutil.exe MD5: 75bd6e532370c06c567718d68e551647 Size: 526.24 KB (526249 bytes) Detections: 28 Type: Executable File Path: %SystemDrive%\Temporary Group: Malware file Last Updated: April 8, 2013
2.	switchbot.dll	2b6c2849652d47844ca395fb6bbc0ffd	16
Name: switchbot.dll MD5: 2b6c2849652d47844ca395fb6bbc0ffd Size: 625.66 KB (625664 bytes) Detections: 16 Type: Dynamic link library Path: C:\Users\<username>\Desktop\Switchbotv3_0_0_5\core\switchbot.dll Group: Malware file Last Updated: September 27, 2022
3.	explorer.exe	af60f0da905591f0a3eb6167f27d7228	13
Name: explorer.exe MD5: af60f0da905591f0a3eb6167f27d7228 Size: 431.1 KB (431104 bytes) Detections: 13 Type: Executable File Path: C:\Kernels\driver\explorer.exe Group: Malware file Last Updated: June 1, 2022
4.	winfile.exe	48ed06fe2d2ed564de0edc6f8d0b123f	10
Name: winfile.exe MD5: 48ed06fe2d2ed564de0edc6f8d0b123f Size: 1.15 MB (1157863 bytes) Detections: 10 Type: Executable File Path: C:\Users\<username>\AppData\Local\Temp\RarSFX0\winfile.exe Group: Malware file Last Updated: January 27, 2023
5.	top1.exe	bb6815957e8359ad22e962525443f908	9
Name: top1.exe MD5: bb6815957e8359ad22e962525443f908 Size: 30.72 KB (30720 bytes) Detections: 9 Type: Executable File Path: %APPDATA% Group: Malware file Last Updated: April 8, 2013
6.	SmitfraudFix.exe	0d5fc73f4e0e92c1d6062759c2f9be7c	8
Name: SmitfraudFix.exe MD5: 0d5fc73f4e0e92c1d6062759c2f9be7c Size: 1.88 MB (1883662 bytes) Detections: 8 Type: Executable File Path: C:\Users\<username>\03 Downloads\Anti virus\SmitFraudFix\SmitfraudFix.exe Group: Malware file Last Updated: November 14, 2023
7.	svchost.exe	61d0fdbddb8763b79054001f591d071a	8
Name: svchost.exe MD5: 61d0fdbddb8763b79054001f591d071a Size: 510.99 KB (510990 bytes) Detections: 8 Type: Executable File Path: C:\Program Files\Java\svchost.exe Group: Malware file Last Updated: June 22, 2021
8.	crss.exe	3a69a4cacb556d519bdcb2fe55772026	6
Name: crss.exe MD5: 3a69a4cacb556d519bdcb2fe55772026 Size: 22.77 KB (22779 bytes) Detections: 6 Type: Executable File Path: %APPDATA% Group: Malware file Last Updated: April 8, 2013
9.	Minings.exe	ffd64908b33efa03d2e6c0e72a53c7af	6
Name: Minings.exe MD5: ffd64908b33efa03d2e6c0e72a53c7af Size: 24.57 KB (24576 bytes) Detections: 6 Type: Executable File Path: %APPDATA%\Mining Group: Malware file Last Updated: April 8, 2013
10.	winmgr.exe	aeba6022c57066e0dd54620e24de1fd5	6
Name: winmgr.exe MD5: aeba6022c57066e0dd54620e24de1fd5 Size: 315.39 KB (315392 bytes) Detections: 6 Type: Executable File Path: %USERPROFILE%\S-100-4902-8593-5693 Group: Malware file Last Updated: April 8, 2013
11.	ucmbgmodqtk.exe	8fdb9757433e2817d4d6c373e140d9da	4
Name: ucmbgmodqtk.exe MD5: 8fdb9757433e2817d4d6c373e140d9da Size: 110.59 KB (110592 bytes) Detections: 4 Type: Executable File Path: %WINDIR%\system32 Group: Malware file Last Updated: April 8, 2013
12.	ff.exe	38019dbdbdbfba812fe15fb1c51e7497	3
Name: ff.exe MD5: 38019dbdbdbfba812fe15fb1c51e7497 Size: 969.07 KB (969072 bytes) Detections: 3 Type: Executable File Path: %USERPROFILE%\Documents\Services Group: Malware file Last Updated: April 8, 2013
13.	5ca13f6c9495c07d.exe	7cdaa4ac0a8d0a56085968001f3df059	3
Name: 5ca13f6c9495c07d.exe MD5: 7cdaa4ac0a8d0a56085968001f3df059 Size: 907.74 KB (907740 bytes) Detections: 3 Type: Executable File Path: %ALLUSERSPROFILE%\Microsoft\Windows\Templates Group: Malware file Last Updated: April 10, 2013
14.	Mouse.exe	77b356cdb23888339ec5c588b5cf51c4	3
Name: Mouse.exe MD5: 77b356cdb23888339ec5c588b5cf51c4 Size: 1.99 MB (1992192 bytes) Detections: 3 Type: Executable File Path: %LOCALAPPDATA%\CheckPoiss Group: Malware file Last Updated: April 8, 2013
15.	wtlsciilrckdg.exe	00840bc9c8249e3ecc21ba268e6e2d5a	2
Name: wtlsciilrckdg.exe MD5: 00840bc9c8249e3ecc21ba268e6e2d5a Size: 304.12 KB (304128 bytes) Detections: 2 Type: Executable File Path: %ALLUSERSPROFILE% Group: Malware file Last Updated: April 8, 2013
16.	lollipop_03161418.exe	fee97f9465a762a2cd3d24aab40f36e0	2
Name: lollipop_03161418.exe MD5: fee97f9465a762a2cd3d24aab40f36e0 Size: 892.41 KB (892416 bytes) Detections: 2 Type: Executable File Path: %USERPROFILE%\impostazioni locali\dati applicazioni\lollipop Group: Malware file Last Updated: April 10, 2013
17.	skype.dat	5ab611b2a806d25c08e9f6fd287b618f	2
Name: skype.dat MD5: 5ab611b2a806d25c08e9f6fd287b618f Size: 131.07 KB (131072 bytes) Detections: 2 Type: Data file Path: %SystemDrive%\Users\<username>\AppData\Roaming Group: Malware file Last Updated: April 8, 2013
18.	{251D6641-2103-0713-3D36-3D014F000C0F}.exe	d0ab6ffee9bc97cdf80e65dc5623130a	1
Name: {251D6641-2103-0713-3D36-3D014F000C0F}.exe MD5: d0ab6ffee9bc97cdf80e65dc5623130a Size: 404.99 KB (404992 bytes) Detections: 1 Type: Executable File Path: %SystemDrive%\Users\<username>\AppData\Roaming Group: Malware file Last Updated: April 8, 2013
19.	WinKeyword.exe	599e792db3be64534286e5637f9adb85	1
Name: WinKeyword.exe MD5: 599e792db3be64534286e5637f9adb85 Size: 221.66 KB (221664 bytes) Detections: 1 Type: Executable File Path: %LOCALAPPDATA%\KoreanKeyword Group: Malware file Last Updated: April 8, 2013
20.	DisrIbs.dll	fa47f6e849daa90cfdd337f667c2f600	1
Name: DisrIbs.dll MD5: fa47f6e849daa90cfdd337f667c2f600 Size: 2.13 MB (2138112 bytes) Detections: 1 Type: Dynamic link library Path: %WINDIR%\system32 Group: Malware file Last Updated: April 10, 2013
21.	ssd.dll	141b43033b11005415ad33411fcf5d59	1
Name: ssd.dll MD5: 141b43033b11005415ad33411fcf5d59 Size: 294.91 KB (294912 bytes) Detections: 1 Type: Dynamic link library Path: D:\Program Files\System Search Dispatcher\1.4.0.970 Group: Malware file Last Updated: May 8, 2013

More files

EnigmaSoft's SpyHunter Scores 100% with AV-TEST in 2024

Search

Change Region

TrojanSpy:Win64/Ursnif.AF

Threat Scorecard

EnigmaSoft Threat Scorecard

Aliases

SpyHunter Detects & Remove TrojanSpy:Win64/Ursnif.AF

File System Details

Submit Comment

Trending

Uazq Ransomware

PDFSpark

Baseauthenticity.co.in

Most Viewed

Discord Shows Black Screen when Sharing Screen

How To Fix 'Printer Driver is Unavailable' Error

What is Msedge.exe?