Should I remove “Cerbu.146237”?

The Cerbu.146237 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Cerbu.146237 virus can do?

• Behavioural detection: Executable code extraction – unpacking
• SetUnhandledExceptionFilter detected (possible anti-debug)
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Anomalous file deletion behavior detected (10+)
• Dynamic (imported) function loading detected
• Reads data out of its own binary image
• Drops a binary and executes it
• The binary contains an unknown PE section name indicative of packing
• Authenticode signature is invalid
• Uses Windows utilities for basic functionality
• Behavioural detection: Transacted Hollowing
• Collects and encrypts information about the computer likely to send to C2 server
• Creates a hidden or system file
• Likely virus infection of existing system binary

How to determine Cerbu.146237?

File Info:
name: 6DD4A691C2CA6115A276.mlw
path: /opt/CAPEv2/storage/binaries/ed05a13e2b9ee38df5660b387b5bda3214cc346189329a8361dfce2cec776ac5
crc32: 459DE324
md5: 6dd4a691c2ca6115a2764a91839633d2
sha1: dbaa2b8c0698d62cda7ed6f744c7040a6297016c
sha256: ed05a13e2b9ee38df5660b387b5bda3214cc346189329a8361dfce2cec776ac5
sha512: 153af7e89715bcb03d0142a7a4918addf163a505b83379f42cc23141a4330e7525cd1a8d2724490639b2ecd4fda8735648c2fafea4431c9615792a8f97672aea
ssdeep: 196608:WoZw6G62vHCebK+qYcJRX2t7JCZ7PlaeFI27LrqrGWLEu:zUFvierqhl2t7yPlaM4rHj
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1F06633439E481014C0E25B36D9665AAB1B7DFD32672A759B60CCB79F0F76F82220DB43
sha3_384: b4ad3282460f036162ac43aff18a20b6c4fbbfb66d6ea02c6e296e3e16b22e67bda20ee3c2d4ed5557121bb91e794a72
ep_bytes: 558bec83c4cc53565733c08945f08945
timestamp: 1992-06-19 22:22:17

Version Info:
Comments: This installation was built with Inno Setup.
CompanyName: Bisvin, LLC                                                 
FileDescription: Bisvin Disk Cleaner Free                                    
FileVersion: 1.2.0.17            
LegalCopyright:                                                                                                     
Translation: 0x0409 0x04e4

Cerbu.146237 also known as:

How to remove Cerbu.146237?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.