Malware

Cerbu.90700 malicious file

Malware Removal

The Cerbu.90700 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Cerbu.90700 virus can do?

  • Behavioural detection: Executable code extraction – unpacking
  • Sample contains Overlay data
  • Presents an Authenticode digital signature
  • CAPE extracted potentially suspicious content
  • The binary contains an unknown PE section name indicative of packing
  • Authenticode signature is invalid
  • CAPE detected the embedded win api malware family
  • Yara detections observed in process dumps, payloads or dropped files

How to determine Cerbu.90700?



File Info:

name: C1CF32D6750CD40B9DC2.mlw
path: /opt/CAPEv2/storage/binaries/03af8271cfcaad7b77d80744030e06c4b8c018edd42d57b017db685c57c6b21c
crc32: 0E73A0F7
md5: c1cf32d6750cd40b9dc21b837c0ccaac
sha1: cc1dd6a855e10dbc792a0bc64004ccc261461527
sha256: 03af8271cfcaad7b77d80744030e06c4b8c018edd42d57b017db685c57c6b21c
sha512: f1683451c0e10ab30d5a765fd55ed472fff87911151182c127f18b1eb4faea5ccd277a161f555667a81a56fc6efcc335fc7ce9b086a578ddf24adc1a4f593c30
ssdeep: 6144:HlwCx1SYEdaaozQgHQQN+JWNPTL1ewYe7KxNuH:KCx1SRa/5nNKeL1f7gMH
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T176D4F21DB4887F33F9F292741407E272E0BADD1522237C4767E0F54ABAB06A919323B5
sha3_384: cc716d472f40a137aaa07939f753cc4c8ad813c2169eb46b97ca85fd4a83a028c15edf32988e15dc9938b598730d915d
ep_bytes: 558bec833d3815490000740f6a15e80d
timestamp: 2021-02-10 15:42:54


Version Info:

CompanyName: Microsoft Corporation
FileDescription: Command Line Interface for Microsoft® Volume Shadow Copy Service 
FileVersion: 6.1.7600.16385 (win7_rtm.090713-1255)
InternalName: VSSADMIN.EXE
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFilename: VSSADMIN.EXE
ProductName: Microsoft® Windows® Operating System
ProductVersion: 6.1.7600.16385
Translation: 0x0409 0x04b0

Cerbu.90700 also known as:

BkavW32.AIDetectMalware
Elasticmalicious (high confidence)
MicroWorld-eScanGen:Variant.Cerbu.90700
FireEyeGeneric.mg.c1cf32d6750cd40b
SkyhighGenericRXNP-ZQ!C1CF32D6750C
McAfeeGenericRXNP-ZQ!C1CF32D6750C
MalwarebytesMachineLearning/Anomalous.100%
ZillyaDownloader.Cridex.Win32.309
SangforTrojan.Win32.Save.a
K7GWTrojan ( 00577a711 )
K7AntiVirusTrojan ( 00577a711 )
SymantecML.Attribute.HighConfidence
ESET-NOD32a variant of Win32/Kryptik.HJJV
APEXMalicious
AvastWin32:DangerousSig [Trj]
CynetMalicious (score: 99)
KasperskyHEUR:Trojan.Win32.Qshell.vho
BitDefenderGen:Variant.Cerbu.90700
TencentMalware.Win32.Gencirc.115cc51f
EmsisoftGen:Variant.Cerbu.90700 (B)
F-SecureTrojan.TR/AD.Dridex.wfq
DrWebTrojan.Dridex.735
VIPREGen:Variant.Cerbu.90700
Trapminemalicious.high.ml.score
SophosML/PE-A
JiangminTrojan.Qshell.dx
GoogleDetected
AviraTR/AD.Dridex.wfq
MAXmalware (ai score=83)
Antiy-AVLGrayWare/Win32.Kryptik.ehls
Kingsoftmalware.kb.a.1000
MicrosoftTrojan:Win32/Dridex.KD!MTB
ArcabitTrojan.Cerbu.D1624C
ZoneAlarmHEUR:Trojan.Win32.Qshell.vho
GDataGen:Variant.Cerbu.90700
VaristW32/Dridex.CA.gen!Eldorado
AhnLab-V3PUP/Win32.RL_Generic.R366129
Acronissuspicious
BitDefenderThetaGen:NN.ZexaF.36804.Ly1@aKbFx8gi
ALYacGen:Variant.Cerbu.90700
VBA32BScope.Trojan-Spy.Zbot
Cylanceunsafe
PandaTrj/GdSda.A
RisingDownloader.Cridex!8.F70 (TFE:4:g2lv3Qpu5SL)
IkarusTrojan.Crypt3
MaxSecureTrojan.Malware.300983.susgen
FortinetW32/Kryptik.HJJV!tr
AVGWin32:DangerousSig [Trj]
DeepInstinctMALICIOUS

How to remove Cerbu.90700?

Cerbu.90700 removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment