How to remove “Trojan-Ransom.Win32.Surtr”?

The Trojan-Ransom.Win32.Surtr is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan-Ransom.Win32.Surtr virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Executed a command line with /C or /R argument to terminate command shell on completion which can be used to hide execution
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Possible date expiration check, exits too soon after checking local time
• Dynamic (imported) function loading detected
• Enumerates running processes
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Disables automatic termination of applications that block or cancel shutdown
• Authenticode signature is invalid
• Uses Windows utilities for basic functionality
• Behavioural detection: Injection (Process Hollowing)
• Executed a process and injected code into it, probably while unpacking
• Queries information on disks, possibly for anti-virtualization
• Attempts to delete or modify volume shadow copies
• Behavioural detection: Injection (inter-process)
• Modifies boot configuration settings
• Created a process from a suspicious location
• Disables host Power options (shutdown, logoff, lock, change password)
• Attempts to disable Windows Defender
• Uses suspicious command line tools or Windows utilities

How to determine Trojan-Ransom.Win32.Surtr?

File Info:
name: B77514E86366E4AC9D62.mlw
path: /opt/CAPEv2/storage/binaries/66d93b00e10a17442c623de8f54223975196d69663f2101a1966db18f9317948
crc32: D4EA0F4A
md5: b77514e86366e4ac9d62dd4eaa97d52c
sha1: c4c1c0108cd7b1a1e2009abc4b12e9791e36db27
sha256: 66d93b00e10a17442c623de8f54223975196d69663f2101a1966db18f9317948
sha512: da0e664dbea5f8c9105db8010dfc15c6ff510e11c8ff93e8808c717187dd9af9a92c7cd97885674fd0e4a0d48dd30822c7b6f2a30a94cebb7dc315be0290dd90
ssdeep: 6144:1953IqyEtyYa7I7f/psEpxC4p7mu+C5zVvRYTK4XRaWXHjhHQtaE4Yle:1953BdL/pH/CTEzVvm24XRaW3dwR4Yle
type: PE32 executable (console) Intel 80386, for MS Windows
tlsh: T13874021475D1C0B3D4B2383949A0DBE15E7DFA705E649FAFB78815394F302C0DA2ADAA
sha3_384: 5cf659cb7b0fee5de3bb5f0f98b542bc38cf16d281faac4ce93b8e339911211bb5de41e96508f7065e1c2379ac55196b
ep_bytes: e8c5030000e974feffff558bec6a00ff
timestamp: 2021-12-05 17:43:26

Version Info:
0: [No Data]

Trojan-Ransom.Win32.Surtr also known as:

How to remove Trojan-Ransom.Win32.Surtr?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.