Cerbu.24549 malicious file

The Cerbu.24549 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Cerbu.24549 virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• NtSetInformationThread: attempt to hide thread from debugger
• Dynamic (imported) function loading detected
• Enumerates running processes
• Expresses interest in specific running processes
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Unconventionial binary language: Russian
• Unconventionial language used in binary resources: Russian
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Checks for the presence of known windows from debuggers and forensic tools
• Checks for the presence of known devices from debuggers and forensic tools
• Detects VirtualBox through the presence of a device
• Anomalous binary characteristics

How to determine Cerbu.24549?

File Info:
name: EA8FD164815F6FA5278A.mlw
path: /opt/CAPEv2/storage/binaries/7629eb61e0295f33a18fe3d489141512af81462ea204f9af99c43f4c8a302be9
crc32: D1C24E70
md5: ea8fd164815f6fa5278a5b63900d0434
sha1: dd6438e40a425763f1aa1cd1edb4c9c271241e4e
sha256: 7629eb61e0295f33a18fe3d489141512af81462ea204f9af99c43f4c8a302be9
sha512: fcec30b05917e4af5ccfe16c0dad3f0d5769e5634a71b3ad09c797f77993b3bb40c84462c860192b0eeb9e8b8003d5d475ea076adcd02d78c0097f5da8e6ffcc
ssdeep: 49152:B3Cxv75uCZc7To4qcmo9cAcUcLALkhLP4Avmru2yjJEZjVBZoA1Lx2Oo9R3v17we:4v75Rc7Tzmo9UUcLHPvvmCrjojfZoA1u
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T178D53327F2F85A20E4206D32CAD74B94C391FD8272789777239237CEBF76A186515839
sha3_384: 76509dc5fec8f8fdf2f1a6d9c0c87eae650a9d9ab1b0fd466c24205d60b1c4b3daf15310a566daed8c88a6fb1a8fc429
ep_bytes: eb03e86cbb50eb01f0e81c000000eb03
timestamp: 1992-06-19 22:22:17

Version Info:
CompanyName: Алексей Занорин
FileDescription: Мотортестер Diamag 2
FileVersion: 2.1.0.0
InternalName: 
LegalCopyright: (С) Алексей Занорин 2012
LegalTrademarks: 
OriginalFilename: diamag2.exe
ProductName: Мотортестер  DIAMAG 2
ProductVersion: 1.6
Comments: 
Translation: 0x0419 0x04e3

Cerbu.24549 also known as:

How to remove Cerbu.24549?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.