Malware

Cerbu.124260 removal guide

Malware Removal

The Cerbu.124260 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Cerbu.124260 virus can do?

  • Behavioural detection: Executable code extraction – unpacking
  • SetUnhandledExceptionFilter detected (possible anti-debug)
  • Yara rule detections observed from a process memory dump/dropped files/CAPE
  • Creates RWX memory
  • Dynamic (imported) function loading detected
  • Enumerates running processes
  • CAPE extracted potentially suspicious content
  • Unconventionial language used in binary resources: Spanish (Honduras)
  • The binary contains an unknown PE section name indicative of packing
  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid
  • Steals private information from local Internet browsers
  • Likely virus infection of existing system binary

How to determine Cerbu.124260?



File Info:

name: 2F7852E97FBC71E6DEA7.mlw
path: /opt/CAPEv2/storage/binaries/2bb38e022e202e267802920ca4aa2b958a61995e1e3d29abc8cad4e196f5459d
crc32: 53B73344
md5: 2f7852e97fbc71e6dea7b1abc682067c
sha1: 285dab772b7e9ffd4699eee36f65ff8560f22153
sha256: 2bb38e022e202e267802920ca4aa2b958a61995e1e3d29abc8cad4e196f5459d
sha512: 85e51ba62577aafdb1b8ca8a8f575fc7b955741c30d2621032fca84c28c6b4c5c21165ccb56f71d995cff545056946008697e507a18a4f1ce467f9289f3d81b5
ssdeep: 49152:DbUMhgWHcPD/H5Relx0DtTWRZIxSHq98eABwpN:HUOHcPDfTebWejYA
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1F3D5BF476BECD822E6738078D4A70AFD062EBC22DA35C44753F27C1DB9F1A9D6861316
sha3_384: 4733a236a225a3ac736da4451d93bae561278ff0674f0b2bbc71f1f45bd4990e6163b5dbfc3bdfa8b828e4958fd6c4b6
ep_bytes: 558bec6aff68188b5700684466570064
timestamp: 2021-11-26 02:01:04


Version Info:

CompanyName: Vincenzo Iuorno
FileDescription: LookDisk
FileVersion: 5.4.0.68
InternalName: LookDisk
LegalCopyright: Copyright by Vincenzo Iuorno
LegalTrademarks: 
OriginalFilename: 
ProductName: LookDisk
ProductVersion: 5.4
Comments: 
Last Compile: 2012-04-06 17:44
Translation: 0x0409 0x04e4

Cerbu.124260 also known as:

BkavW32.AIDetect.malware2
LionicTrojan.Win32.Injuke.4!c
Elasticmalicious (high confidence)
MicroWorld-eScanGen:Variant.Cerbu.124260
FireEyeGeneric.mg.2f7852e97fbc71e6
McAfeeGenericRXRA-AD!2F7852E97FBC
CylanceUnsafe
CrowdStrikewin/malicious_confidence_60% (W)
AlibabaTrojan:Win32/Injuke.f9ccc0dc
K7GWTrojan ( 005690671 )
K7AntiVirusTrojan ( 005690671 )
SymantecML.Attribute.HighConfidence
ESET-NOD32a variant of Win32/Kryptik.HLIQ
APEXMalicious
Paloaltogeneric.ml
KasperskyHEUR:Trojan.Win32.Injuke.gen
BitDefenderGen:Variant.Cerbu.124260
AvastWin32:AdwareX-gen [Adw]
TencentWin32.Trojan.Injuke.Huge
Ad-AwareGen:Variant.Cerbu.124260
SophosMal/Generic-S
DrWebTrojan.Siggen15.60235
TrendMicroTROJ_GEN.R002C0WL421
McAfee-GW-EditionBehavesLike.Win32.PUP.vc
EmsisoftGen:Variant.Cerbu.124260 (B)
SentinelOneStatic AI – Malicious PE
GDataWin32.Trojan.PSE.1IAKRUN
AviraHEUR/AGEN.1142521
MicrosoftTrojan:Win32/Sabsik.FL.B!ml
CynetMalicious (score: 100)
AhnLab-V3Adware/Win.Generic.R456332
BitDefenderThetaGen:NN.ZexaCO.34062.XE0@aWZvZ7iU
MAXmalware (ai score=82)
TrendMicro-HouseCallTROJ_GEN.R002C0WL421
RisingTrojan.Kryptik!1.AA55 (CLASSIC)
IkarusTrojan.Win32.Crypt
FortinetW32/Kryptik.HATU!tr
AVGWin32:AdwareX-gen [Adw]
PandaTrj/CI.A

How to remove Cerbu.124260?

Cerbu.124260 removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment