Categories: Malware

Cerbu.140561 malicious file

The Cerbu.140561 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Cerbu.140561 virus can do?

Behavioural detection: Executable code extraction – unpacking
Performs HTTP requests potentially not found in PCAP.
Unconventionial binary language: Chinese (Simplified)
Unconventionial language used in binary resources: Chinese (Simplified)
Authenticode signature is invalid
Attempts to modify proxy settings
Touches a file containing cookies, possibly for information gathering
Anomalous binary characteristics
Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Cerbu.140561?


File Info:
name: 217DE32F1F224164A34A.mlwpath: /opt/CAPEv2/storage/binaries/4831ac0341ee8cd1f1782785cf9f8706904fd1b583da8ba2c6de54051db5df97crc32: D206CAE2md5: 217de32f1f224164a34a6360403709ccsha1: ae6ecdd862acbd08d23deb255fbabbcfdf16db38sha256: 4831ac0341ee8cd1f1782785cf9f8706904fd1b583da8ba2c6de54051db5df97sha512: 6c21a1db16a15fcba2babc8ca93f71c56de0846a53a4e7437a0e4bf5aafa8b63c7c80c76e1be0ad6bc65ff9a783b113c81c9ea6126e905d8470352448b8f465essdeep: 12288:nor/pQfu8E4B+6z/I4NOPKdIYkCHD72bUlCKO7dUw79T1toxH:0/pou9YnrGTCHDibUlCUTHtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T128E46C553BA0E072C26D21B1C99BD3F566A5AC30CB3646E726A03E3D7E305C25E3963Dsha3_384: feee86bdcee8213ae76da338ccb86c10f6e92135880bafd676fca6fcbc7118441f4de174f1b23fadf03fb962e6f169abep_bytes: e84e6a0000e979feffff3b0d00cb4700timestamp: 2013-12-18 14:53:00
Version Info:
CompanyName: Microsoft CorporationFileDescription: Microsoft Internet ExplorerFileVersion: 13, 12, 18, 2LegalCopyright: Microsoft (C) 保留所有权利。ProductName: Microsoft Internet ExplorerProductVersion: 13, 12, 18, 2Translation: 0x0804 0x03a8

Cerbu.140561 also known as:

Bkav	W32.Common.F8232D1B
MicroWorld-eScan	Gen:Variant.Cerbu.140561
FireEye	Generic.mg.217de32f1f224164
ALYac	Gen:Variant.Cerbu.140561
Sangfor	Suspicious.Win32.Save.ins
K7AntiVirus	Trojan ( 0040f9501 )
K7GW	Trojan ( 0040f9501 )
Cybereason	malicious.f1f224
BitDefenderTheta	Gen:NN.ZexaF.36318.Pq0@aqkUNlkj
VirIT	Trojan.Win32.Agent4.BVXR
Cyren	W32/FakeIE.A.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/FakeIE.AF
APEX	Malicious
ClamAV	Win.Trojan.Fakeie-11
Kaspersky	HEUR:Trojan.Multi.Generic
BitDefender	Gen:Variant.Cerbu.140561
NANO-Antivirus	Trojan.Win32.FakeIE.detxwo
SUPERAntiSpyware	Trojan.Agent/Gen-FakeMS
Tencent	Malware.Win32.Gencirc.10b2dbc5
Sophos	ML/PE-A
Baidu	Win32.Trojan.FakeIE.a
F-Secure	Trojan.TR/Downloader.Gen7
DrWeb	Trojan.FakeIE.10
VIPRE	Gen:Variant.Cerbu.140561
Emsisoft	Gen:Variant.Cerbu.140561 (B)
Google	Detected
Avira	TR/Downloader.Gen7
Antiy-AVL	Trojan/Win32.SGeneric
Xcitium	TrojWare.Win32.TrojanDownloader.FakeIE.FAK@5t4qvw
Arcabit	Trojan.Cerbu.D22511
ZoneAlarm	HEUR:Trojan.Multi.Generic
GData	Gen:Variant.Cerbu.140561
Cynet	Malicious (score: 99)
AhnLab-V3	Trojan/Win32.FakeAlert.R120601
VBA32	TrojanDownloader.FakeIE
MAX	malware (ai score=88)
Malwarebytes	Generic.Malware.AI.DDS
Rising	Downloader.FakeIE!8.198 (TFE:5:cU3dmodIL9T)
Yandex	Trojan.FakeIE!4V8COijcukQ
Ikarus	Trojan-Spy.Win32.Delf
MaxSecure	Trojan.Malware.4388231.susgen
Fortinet	W32/FakeIE.AF!tr
Panda	Trj/Genetic.gen
CrowdStrike	win/malicious_confidence_90% (D)