Should I remove “Ser.Ursu.512”?

The Ser.Ursu.512 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Ser.Ursu.512 virus can do?

• Behavioural detection: Executable code extraction – unpacking
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• Unconventionial language used in binary resources: Russian
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• A scripting utility was executed
• Uses Windows utilities for basic functionality
• Behavioural detection: Injection (Process Hollowing)
• Behavioural detection: Injection (inter-process)
• Creates a copy of itself
• Attempts to disable Windows Defender
• Attempts to modify Windows Defender using PowerShell
• Anomalous binary characteristics
• Uses suspicious command line tools or Windows utilities

How to determine Ser.Ursu.512?

File Info:
name: 1D36E1541D5096F08ECE.mlw
path: /opt/CAPEv2/storage/binaries/4def281cac60a8bd0cad996f6af01339e52f8515986554fd3121d02e5f0d6922
crc32: FC758EE0
md5: 1d36e1541d5096f08ece43f70daeeac4
sha1: 0b2d48f93c64e9172a202a43bf49bc541e8d5768
sha256: 4def281cac60a8bd0cad996f6af01339e52f8515986554fd3121d02e5f0d6922
sha512: ef9ead327de4fc2e59be86bbd1b176ac7dfb88fa6188d5db53f24e07151eb1ca616901d4262b434ccb46347b82fbd698f0edbb79eeb2172ef3683f0450684216
ssdeep: 12288:ty4eiUgyn+xsrfZBQpoEerW7JZh5u5M8N:YWMVqponWF/5u5t
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T11894D011C8094668F50014352C6B7BEA68E57CF16CA67987EA04FE7B3D712F7A07E623
sha3_384: 8ce567846799f1686c15508622452db72c0be735eee75ff2c142e31b5de91eaaba65c3e2e02d7b109559c4f2e4e36e9d
ep_bytes: 68e8184000e8eeffffff0000ffcc3100
timestamp: 2018-07-23 16:09:48

Version Info:
Translation: 0x0409 0x04b0
CompanyName: Safo s.r.o.
FileDescription: Celtic Theme Song Remix
ProductName: GraphAmort
FileVersion: 1.00
ProductVersion: 1.00
InternalName: GraphAmort
OriginalFilename: GraphAmort.exe

Ser.Ursu.512 also known as:

How to remove Ser.Ursu.512?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.