Cerbu.148497 (file analysis)

The Cerbu.148497 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Cerbu.148497 virus can do?

• Behavioural detection: Executable code extraction – unpacking
• SetUnhandledExceptionFilter detected (possible anti-debug)
• Sample contains Overlay data
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• A file with an unusual extension was attempted to be loaded as a DLL.
• Checks adapter addresses which can be used to detect virtual network interfaces
• Possible date expiration check, exits too soon after checking local time
• Dynamic (imported) function loading detected
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• The binary contains an unknown PE section name indicative of packing
• Authenticode signature is invalid
• Uses Windows utilities for basic functionality
• Behavioural detection: Transacted Hollowing
• Likely virus infection of existing system binary

How to determine Cerbu.148497?

File Info:
name: 0650F719C1CC3BFD046B.mlw
path: /opt/CAPEv2/storage/binaries/35f102d0f1f3625e1b392bdcbb1d932c767f34a35b174004f5a380d0633d565c
crc32: FCEF4B40
md5: 0650f719c1cc3bfd046bf9138a3fcbb6
sha1: 00531e478aad8bfdb9a37dbda0aa818134b4cfd4
sha256: 35f102d0f1f3625e1b392bdcbb1d932c767f34a35b174004f5a380d0633d565c
sha512: 22163cdfe0a5fa10b59cfbe3d9ec0ad8d1f386b74776414f1b32f0fa9940493394503ac978c1ffeadfcf1cfe085a016d8093650c95a3ceeef067a192e8621f92
ssdeep: 196608:+ryeDw7aobwi4SsSiLFYZJ2J2qKFFSNg+lPAq1qCYdk:ekxwiUSiLqZjBFF+VlYq1t7
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1A8763306468FC039E5F3A371FA6B14DE8C72B3F6AF17595E6A5844780D208318CB97B9
sha3_384: 21b0096a23eb14c0c4e72afd317ad38872a4b22adb73deb738d2ce24548c23da436d9b0ad48d08cb5ea62d7020a96fa9
ep_bytes: 558bec83c4d453565733c08945f08945
timestamp: 1992-06-19 22:22:17

Version Info:
Comments: This installation was built with Inno Setup: http://www.innosetup.com
CompanyName: LionMaz Software                                            
FileDescription: Everyday Auto Backup                                        
FileVersion: 1.0.0.37            
InternalName: 
OriginalFilename: 
ProductName: 
ProductVersion: 
Translation: 0x0409 0x04e4

Cerbu.148497 also known as:

How to remove Cerbu.148497?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.