Cerbu.129901 information

The Cerbu.129901 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Cerbu.129901 virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Dynamic (imported) function loading detected
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• The binary contains an unknown PE section name indicative of packing
• Authenticode signature is invalid
• Likely virus infection of existing system binary

How to determine Cerbu.129901?

File Info:
name: ECC70C45DFA2C9D0D6B8.mlw
path: /opt/CAPEv2/storage/binaries/092acfd39e4705662c300f781076fee48f510dd6ca9e90be088e8f3703b4d656
crc32: FBF638F5
md5: ecc70c45dfa2c9d0d6b87078be8c89e1
sha1: 6c8494df07be76491427d93cef562b992c1e7ac0
sha256: 092acfd39e4705662c300f781076fee48f510dd6ca9e90be088e8f3703b4d656
sha512: bdd2e446b199604a8e54a7e66898df7d324139e2466690a5e63bbf010e6604a710f5497f3f07f39cbb9062c919dd77e0c703891f6a999db61fb5c7ade776ca7b
ssdeep: 196608:hDh20bHN7z6wip3DNVuPNsmQRdqnVjVNu9rUP8GZK8NbT6o3jn7b8r7oUuetYEB5:C0bHN7/PNs1GnMo8GZPT6Yjn7beoULu6
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T10FB6233FB228653ED4AA4B3245B39310987BBF61A91A8C2E47F0181DCF765701E3F656
sha3_384: ecbfbdd07cb1cac9089fa0f8c4305d202842a869162c89fb15abda0f2dbce8597940affe852ca3b71284a3b20bc34860
ep_bytes: 558bec83c4a453565733c08945c08945
timestamp: 2020-03-14 17:59:41

Version Info:
Comments: This installation was built with Inno Setup.
CompanyName: jMobie Inc.                                                 
FileDescription: ABPhoneRescue Setup                                         
FileVersion:                     
LegalCopyright:                                                                                                     
OriginalFileName:                                                   
ProductName: ABPhoneRescue                                               
ProductVersion: 2.1.1.13                                          
Translation: 0x0000 0x04b0

Cerbu.129901 also known as:

How to remove Cerbu.129901?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.